Some Clients Will Soon Be Locked Out of Files You Shared Last Year. Is Yours One of Them?

Somewhere in your SharePoint or OneDrive there is a folder that a client opens by typing a six-digit code from an email. Nobody ever set that client up as a user. It simply worked, so nobody thought about it again. Microsoft is now removing that mechanism, and the first people to notice will be your clients, not your IT team.

The fix takes minutes per person once you know where to look. A Microsoft 365 security assessment lists who your tenant shares with today, which is the list you need before the switch reaches you.

Quick answers

What exactly is being retired? The SharePoint one-time passcode sign-in that external people used for "specific people" links. Microsoft's own FAQ says it is retired for commercial tenants during October 2026. The separate email passcode inside Microsoft Entra is not being retired.

Can we opt out or choose the date? No. Microsoft's FAQ states that commercial tenants cannot opt out, and that tenants are selected automatically with no way to pick a date.

Which links stop working? Previously shared "specific people" links for external users who have no matching guest account in your directory. Links for people who already have a guest account keep working, and so do "Anyone" links.

How do we get someone back in? Create a guest account for their email address, or share or reshare one file, folder or site with them. One reshare restores access to everything previously shared with that person.

How did external sharing work until now, and what replaces it?

When an employee shared a file with "specific people" outside the company, SharePoint could verify the recipient on its own. It emailed a one-time code, the recipient typed it in, and they were through. No account was created in your Microsoft 365 directory, so it also left no entry that anyone could review later.

The replacement uses Microsoft Entra B2B guest accounts. The recipient becomes a guest user in your directory, and signs in with a code, their own Microsoft account or their own company login. Microsoft's FAQ for admins confirms that new external sharing already goes through this route and cannot be switched back.

From the recipient's side, little changes if they already have a guest account. If they do not, the first reshare creates one automatically.

Who gets locked out, and who does not?

Three groups, and only one of them has a problem.

Guests who already have an account. Nothing changes for them. Regular partners you have invited into Teams or shared with more than once are likely to be in this group.

People who only ever used the emailed code. This is the exposed group. According to Microsoft's FAQ, once retirement reaches your tenant they get "access denied" on older "specific people" links until a matching guest account exists. These are typically a bookkeeper, an external lawyer, a freelance designer or a client portal folder that was set up two years ago.

Anyone with an "Anyone" link. Microsoft states that this change does not affect anonymous links. They stay as open or as restricted as your sharing policy already made them. If you want to tighten that as well, our article on Microsoft 365 Baseline Security Mode explains what the default sharing settings expose.

One exclusion is worth knowing: per the Message Center notice, government clouds (GCC, GCC High, DoD) are left out for now. Normal commercial tenants are in scope.

When does this actually reach your tenant?

The dates differ slightly between Microsoft's own pages, which is itself a reason not to plan around a single day. The Learn FAQ says the retirement rolls out to commercial tenants during October 2026. The Message Center notice MC1243549, in its version of October 1, says retirement begins in mid-October and is expected to be complete for production tenants by the end of November.

Earlier versions of the same notice named July and August. The schedule moved, and may move again. The practical reading: treat the second half of October as the start, and have your list ready before then. The date for your own tenant is not published, so the safe assumption is "any day now".

What should a 15-person agency do this week?

Take a marketing agency with 15 employees as the example. Over the years its staff have shared campaign files with freelancers, print shops and a handful of clients, and nobody kept a list. Six steps cover it, and none needs a purchase.

1. Find the people. Microsoft's FAQ points to the external sharing report at site level. It lists guests that were invited through the old passcode route and have no Entra guest account yet, in the "User E-mail" column. Run it for the sites that hold client work first. Our marketing agency clients usually have the longest lists, because freelancers come and go.

2. Decide who still needs access. Not everyone on that list should come across. A freelancer from a project that ended last year does not need a guest account. Let the access lapse on purpose rather than by accident.

3. Create the guest accounts you want to keep. An administrator can add them in the Entra admin center using the email address from the original link, as described in Microsoft's guide to adding guest users. The alternative is for a colleague with sharing rights to reshare one item with the person, which creates the account automatically. Microsoft says no duplicate accounts are created.

4. Check that people may invite at all. If your tenant restricts who can invite guests, the automatic account creation will not work for ordinary employees. The Message Center notice suggests assigning the Guest Inviter role to those who share externally.

5. Keep email passcodes switched on in Entra. The notice says to leave the email one-time passcode setting enabled in the External ID settings if your organization relies on it. Guests without a Microsoft account sign in that way. Details are in Microsoft's documentation on email passcodes.

6. Tell your staff. The colleagues who share files will get the first annoyed email. A two-line note helps: from mid-October some outside recipients may see "access denied", and resharing the item once fixes it. Ask them to pass such reports to whoever looks after Microsoft 365, and not to improvise by sending files as email attachments, which moves the data out of your control.

Is this a loss, or a gain in control?

Both, and it is worth saying so. The loss is plain: for a few weeks some of your clients will hit a wall, and the person they call is whoever shared the file. That is a support burden and a small reputation cost, which is why the preparation above matters more than the technology.

The gain is that external people stop being invisible. With guest accounts, your Conditional Access rules and sign-in logs cover them, and Microsoft's notice says guest governance policies apply as well. A client who was previously "just a code" now sits in a list you can read, review and clean up. That matters for law practices that need to show who could see a matter file, a question that usually arrives after an incident. Our law firm clients are the ones who ask for this list first.

There is a cost on the other side too. A guest list grows. Without a yearly review, you end up with accounts of people who left their company long ago, and each one is a sign-in route into your tenant. The same logic that applies to staff applies here: a standing door nobody checks is a risk. If you already moved your staff away from text-message sign-in codes, as described in our article on SMS sign-in codes ending, apply the same attention to guests.

What belongs in your sharing policy afterwards?

Use the switch as a reason to write down three rules, because most small companies have none.

First, who may share outside the company. Not every employee needs that right on every site. Second, how long a guest keeps access. A project folder should have an end date, and someone should own it. Third, what a guest must do to sign in. Because guests now fall under your Conditional Access rules, you can require multi-factor authentication for them as you do for staff. The external collaboration settings are where invitations are controlled.

For companies under the NIS2 directive or with ISO 27001 plans, this is also the sort of evidence an auditor asks for: a list of external accounts, an owner, a review date. An IT governance and compliance review turns the three rules into a one-page policy and a recurring check.