That File Link You Sent a Client? It May Have Just Stopped Working.

Somewhere this month, a client opened an email, clicked a file link you sent them weeks or months ago, and saw: Access Denied. No warning. No explanation. Just a dead link. If that has already happened — or if it hasn't yet and you want to get ahead of it — this post is for you.

What Changed, in Plain English

For years, when you shared a file from SharePoint or OneDrive with someone outside your company, Microsoft sent them a one-time passcode — a six-digit code in a separate email they had to enter to open the file. Simple. Familiar. It worked like a delivery locker code.

That system is now gone. Microsoft officially retired the one-time passcode (OTP) method for external file sharing during October 2026, with the changeover running from October 1 through October 31 across standard business accounts. There is no opt-out.

The replacement is a system called Microsoft Entra B2B (Entra is Microsoft's identity and access platform; B2B stands for business-to-business). Instead of a temporary code, every outside person you share files with now gets a formal guest account in your Microsoft directory. Think of it less like a locker code and more like giving someone a temporary visitor badge that your front desk can track, revoke, or expire.

Since May 2026, every new share you created already used this guest-account method automatically. That part rolled out quietly and, for most businesses, worked fine. The problem sitting in your inbox right now is the old links — ones sent before May 2026 under the passcode system.

The Part That Stings: It Fails Silently

This is the detail that turns an inconvenience into a real business problem. When an old OTP-based link stops working, neither you nor your client gets a notification. The external recipient simply hits an access-denied wall. You have no idea it happened unless they call you to complain — or, worse, they give up and don't tell you at all.

Think about what lives in those old links: a proposal you sent a prospect, a contract you shared with a vendor, a design file a contractor has been referencing, a report your accountant bookmarked. Any of those could be broken right now.

As one tracking service summarized Microsoft's own Message Center notice (MC1243549): external users who currently access content via old OTP links will lose access — silently, with no automatic notification to them or to you.

What the New System Actually Means for You

The good news: going forward, the new guest-account system is more secure and more manageable. When you share a file with an outside person today, Microsoft automatically creates a lightweight guest account for them in your Entra directory. That means your IT provider (or you) can see who has access to what, set expiration dates, and revoke access when a project ends or a relationship changes. That is a genuine improvement over the old passcode method, which left no real audit trail.

The trade-off is a tiny bit more friction for first-time external recipients. They will need to accept a guest-account invitation the first time. After that, the experience is largely the same as before.

What to Do or Ask This Week

1. Ask your IT provider to pull a list of external users still on the old OTP system. This is a specific report that can be run from the Microsoft 365 admin center or via PowerShell (a behind-the-scenes tool your IT provider uses). You want to know exactly which outside people had file access and may now be locked out.
2. Reshare critical files with those people. Simply resending a share from SharePoint or OneDrive today will create a proper guest account for them. New shares work correctly. This takes minutes per file.
3. Verify your Entra settings allow guest invitations. Your IT provider should confirm that your Microsoft Entra External Identities settings are configured to permit B2B guest accounts. If that setting is off, new shares will fail too.
4. Give your most important external contacts a heads-up. A quick email — "We updated how we share files; if you had trouble accessing something recently, here's a fresh link" — costs you nothing and saves a relationship.
5. Going forward, build a habit of setting expiration dates on guest access. The new system lets you do this. A file link that expires after 30 or 90 days is far cleaner than one that sits open indefinitely.

What This Is Not

This is not a hack, a breach, or a reason to panic. Microsoft made a deliberate architectural decision to unify external identity under a single, more governable system. That decision is defensible. The execution — retiring old links mid-month with no automated outreach to end users — is less elegant. But the fix is straightforward, and the long-term posture is better.

This also is not something you need to pay extra for. The guest-account system is included in your existing Microsoft 365 subscription. The only cost is a conversation with your IT provider and maybe 30 minutes of cleanup.

The Bottom Line

If your business regularly shares files with people outside your company — clients, accountants, lawyers, vendors, contractors — you almost certainly have old OTP-based links that are broken or breaking right now. The fix is simple: identify who those people are, reshare the files, and confirm your settings support the new method.

The right question to ask your IT provider this week is not "what changed?" — it is "which of my external contacts lost access this month, and can we fix it by end of week?"

— David