Last spring somebody in your office sent a folder link to a lender. The email is long gone. The link probably isn't.
If that link was shared as an "Anyone" link, the file loads without asking who is opening it. No sign-in. No code. No record of who has viewed it, how many times, or who they forwarded it to. Microsoft's own description of that link type says the people who receive it can open it without signing in, and are free to pass it on.
That is not a glitch. It is a setting, and it is doing exactly what it was told to do.
What "anyone with the link" really means
When you share a file or folder from OneDrive or SharePoint, the Share button offers a few link types. One of them is Anyone with the link. Microsoft's documentation is about as plain as it gets on this point: people can open the link without authenticating, and nothing stops them handing the link to somebody else.
The default permission on an Anyone link is edit, not view. For a folder, Microsoft notes, that can mean letting a visitor upload new files into it.
An Anyone link can also be set to expire. But only if somebody turns that on. Microsoft's guidance points out that once an Anyone link does expire, the file can simply be reshared with a fresh one.
Why this catches small offices
Large companies have a person whose whole job is this, plus paid tools that inventory what is shared. A twelve-person office in the Upper Peninsula usually has a bookkeeper who also handles payroll, ordering, and the front desk. Reviewing last spring's sharing links is nobody's job.
It is also easy to miss, because Teams files, client folders, and your own OneDrive all sit in SharePoint behind the scenes. Sharing a file from a Teams chat is a SharePoint permission decision, even though it does not feel like one.
Three settings actually worth checking
Sign in to the SharePoint admin center, open Policies, then Sharing. Microsoft documents all three of these.
1. Default link type. Microsoft says that when Anyone sharing is enabled, the default sharing link is normally set to Anyone, and notes this can increase the risk of sharing with someone by accident. Change the default to Only people in your organization. Anyone who genuinely needs a public link then has to pick it on purpose.
2. Link expiration. You can require that all Anyone links expire, and set the maximum number of days they are allowed to live. This one reaches backward. Microsoft says existing links keep their current expiry if the new setting is longer, and update to the new setting if it is shorter.
3. Link permissions. You can restrict Anyone links to view only. A forwarded link then cannot be used to edit the document or drop new files into the folder.
The part that is already out there
Changing a default only affects the next time somebody clicks Share. To see what is already shared, open the file or folder and use Manage access. It shows who has access and which links exist, and you can remove a link right there.
One honest limit. Microsoft's deeper reporting on what is shared across your whole organization, called Data access governance, is not part of a basic plan. For a small office, a monthly pass through the two or three folders that would truly hurt to lose is the practical version.
What this is not
Sharing outside the office is not the problem. Contractors need drawings. Lenders need paperwork. Customers need quotes. The problem is a link that never asks who is holding it, sitting on a default nobody chose.
That is a small fix. It just needs somebody to look, and a free assessment is a reasonable place to start.