OneDrive: "Copy Link" changes files from Private to Shared and creates default "Anyone with the link" access

Question

OneDrive: "Copy Link" changes files from Private to Shared and creates default "Anyone with the link" access

Willow-3455 0

I’m looking for clarification on OneDrive sharing information behaviour and whether what I am seeing is expected.

I originally became aware of this issue when I was trying to print Word documents from the OneDrive iPad app.. While working with the documents I saw anonymous editors appear as Guest Contributor and on another occasion, as Beech (Guest) and Wheatgrass (Guest). I was unable to work with or print the documents normally until those guest sessions ended. Afterwards I noticed the files had changed status from “private” to “shared” This has now happened intermittently 3-4 times over the past year.

It concerned me that my personal files status had been changed to “shared” so I carried out the following tests to understand the sharing behaviour (because I cannot always recreate the guest accounts scenario):

I identified a file with status Private.
I selected Copy Link in the OneDrive iPad app.
I did not send the link to anyone.
The file status immediately changed from Private to Shared.
The sharing permissions showed "Anyone with the link can edit".

I then repeated the test using OneDrive on the web:

File status was Private.
I selected Copy Link.
I closed the window and did not send the link to anyone.
The file status changed from Private to Shared.
The file now showed Anyone with the link can access/edit.

I also tested one of these generated links with a family member and the file could be opened successfully.

My questions are:

Is it expected behaviour that selecting Copy Link automatically creates a sharing link and changes a file from Private to Shared even if the link is not actively sent to anyone.
Is the default copy link type for OneDrive intended to be Anyone with the link can edit?
Is there any way to prevent Copy Link from creating a shareable link without deliberately going in and changing access?
Is there any audit information available that would show when these links were created?
Could anonymous guest editors in Word documents be the result of access via these sharing links?

I am using a personal Microsoft account, not a work account and am looking for clarification on OneDrive sharing of data and whether these guest accounts are malicious.

Deleted

This comment has been deleted due to a violation of our Code of Conduct. The comment was manually reported or identified through automated detection before action was taken. Please refer to our Code of Conduct for more information.
Deleted

This comment has been deleted due to a violation of our Code of Conduct. The comment was manually reported or identified through automated detection before action was taken. Please refer to our Code of Conduct for more information.
Deleted

This comment has been deleted due to a violation of our Code of Conduct. The comment was manually reported or identified through automated detection before action was taken. Please refer to our Code of Conduct for more information.

1 answer

Your answer

Deleted

This comment has been deleted due to a violation of our Code of Conduct. The comment was manually reported or identified through automated detection before action was taken. Please refer to our Code of Conduct for more information.

Answer 1

Ian-T 14,020 Microsoft External Staff Moderator

Hi @Willow-3455

What you observed when selecting Copy Link is generally expected.

Selecting Copy Link immediately creates a sharing link, so the file changes from Private to Shared, even if you do not send the link. For personal OneDrive, Allow editing may be enabled by default.

Before copying a link, open Link settings, choose Specific people where possible, and turn off Allow editing if only viewing is required. To cancel an existing link, open Manage access and remove the link or stop sharing.

Names such as Guest Contributor or randomly generated guest names can appear when someone opens an editable link without signing in. This does not automatically mean the account was hacked, but it indicates an anonymous session accessed the document.

Because personal OneDrive does not provide the same detailed sharing audit log available to organizational accounts, identifying who used an anonymous link may not be possible. Remove any unexpected links, review recent account activity, change the password, and enable two-step verification as a precaution.

Hope this helps, please feel free to let me know if you need any further help.

Willow-3455 0 Reputation points

2026-10-12T06:43:37.9033333+00:00

Thank you for your response. My remaining question is whether the anonymous editing sessions shown as "Guest Contributor", "Beech (Guest)" and "Wheatgrass (Guest)" are consistent with access through an "Anyone with the link can edit" sharing link. Based on my observations, files that later showed guest editors were also found to have active sharing links. Can Microsoft confirm whether this is the most likely explanation for those editing sessions? Thanks
Ian-T 14,020 Reputation points Microsoft External Staff Moderator

2026-10-12T06:55:40.5133333+00:00

Thank you for your response

I understand why those unfamiliar guest names would be concerning.

Those sessions are consistent with someone or an automated service accessing the document through an“Anyone with the link can edit” link. People opening this type of link without signing in may appear as guests, and some email providers’ Safe Browsing features can also create additional guest sessions.

Therefore, the active sharing links are a plausible explanation for Guest Contributor, Beech (Guest), and Wheatgrass (Guest). However, the guest names alone cannot confirm exactly who or what accessed the documents.

As a precaution, remove the existing Anyone links under Manage access and use Specific people links instead. If the unexpected sessions no longer appear, that would further indicate the editable sharing links were the cause.

Hope this helps.
Willow-3455 0 Reputation points

2026-10-12T07:21:48.85+00:00

Thank you. Although I may never be able to determine the identity of the users or services represented by names such as Guest Contributor, Beech (Guest) and Wheatgrass (Guest**)**, I appreciate your confirmation that these sessions are consistent with access via editable sharing links and do not necessarily indicate compromise of my Microsoft account.

I have reviewed my OneDrive files, removed unexpected Anyone links. I might also deactivate my OneDrive account and go back to storing files locally on my laptop only until such time a more robust “cloud” storage solution is available.
Deleted

This comment has been deleted due to a violation of our Code of Conduct. The comment was manually reported or identified through automated detection before action was taken. Please refer to our Code of Conduct for more information.
Ian-T 14,020 Reputation points Microsoft External Staff Moderator

2026-10-12T07:31:59.84+00:00

Hi

You’re welcome, and I completely understand your concern. You have taken the appropriate precaution by reviewing your files and removing the unexpected Anyone links.

It is also understandable if this experience has affected your confidence in cloud storage. If you decide to keep your files locally, please maintain at least one separate backup, such as an external drive, so the laptop is not the only copy.

If you find my answer helpful, feel free to click "Yes" on my answer - this will also help other users having the same question.

Thank you for sharing your detailed observations. Have a lovely day.