Clients getting “access denied” on your shared files? Microsoft has changed how sharing works.

If a client, accountant or supplier has suddenly told you they get “access denied” on a file you shared from OneDrive or SharePoint, nothing is broken on their side. Microsoft is retiring the SharePoint one-time passcode, the emailed code that let people outside your business open a shared file without an account. Its message to admins says the retirement started in mid-October and should be complete for every business tenant by the end of November.

From now on, people outside your business open your files through a guest account in your Microsoft 365. For most links that happens automatically. For older ones it doesn’t, and that’s where the access denied messages come from.

What your clients will see

Type of link	What happens
“Specific people” links shared recently	Nothing changes. A guest account was created for them when you shared it.
“Specific people” links shared before the change	If the person doesn’t have a guest account yet, they get access denied once the retirement reaches your business.
“Anyone with the link” links	Not affected. They still work for anyone holding the link, which is also why they’re best avoided for anything sensitive.

You can’t opt out and you can’t pick the date. Microsoft says businesses are selected automatically.

The quick fix

You don’t have to reshare everything. Microsoft says sharing one file, folder or site with that person again creates their guest account, and that restores their access to everything you’d shared with them before. An admin can also create the guest account directly in Microsoft Entra.

If you’d rather not wait for the phone calls, your Microsoft 365 admin can run the external sharing report for each SharePoint site. Microsoft says it lists the people invited the old way who don’t have a guest account yet, so you can set them up before they notice.

Why this is a good thing

The old passcodes sat outside the rest of your Microsoft 365 security. Guest accounts don’t. Once someone is a guest, they show up in your user list, and the sign-in rules you set for your organisation, such as requiring MFA, can apply to them too.

The catch is that guest lists grow quietly. Every accountant, contractor and supplier you’ve ever shared a folder with becomes a guest, and nobody removes them when the work ends. It’s worth putting a review of guest accounts on the same list as removing leavers, so access ends when the relationship does.

A note you can send your team

Microsoft has changed how people outside the business open files we share from OneDrive and SharePoint. If a client or supplier says they can’t open something we sent a while ago, share any one file with them again from OneDrive or SharePoint, and that should restore their access to the rest. Please use “Specific people” links rather than “Anyone with the link” for anything confidential, and tell [name] if someone still can’t get in.

Sources

• Microsoft Learn: Improvements to external sharing in OneDrive and SharePoint (FAQ)
• Microsoft Learn: SharePoint and OneDrive integration with Microsoft Entra B2B
• Microsoft 365 message centre post MC1243549, Retirement of SharePoint One-Time Passcode (updated 1 October 2026), as seen in the public archive at mc.merill.net