securetools.live • November 2026How to Revoke Access to a Shared File After Sending It
Revocation is five actions in sequence: delete the link, remove named users, rotate any shared password, disable public link settings on the file, and verify in the audit log that further access attempts fail. What revocation cannot do is retrieve copies the recipient already downloaded or screenshotted. This article walks through the mechanics on Google Drive, OneDrive, and Dropbox Business, explains the difference between link deletion and file deletion, covers the handling of departed employees and completed engagements, and provides a reusable revocation checklist. The most common mistake — leaving a file in a shared folder after removing its individual share — is called out explicitly so you can avoid it.
Revoking access to a file is simple in principle and easy to get wrong in practice. The simple part is clicking the revoke button. The easy-to-get-wrong parts are: forgetting the folder-level permission that still grants access, missing a secondary shared link, assuming the revocation reached an active session, and not verifying anywhere that the revocation actually took effect.
This guide covers the mechanics across the common business platforms, the handling of situations where revocation is partial, and the limits of what revocation can achieve. It builds on the parent guide to secure file sharing and complements the permissions explainer.
What Revocation Actually Means
Revocation ends the live channel between the sender's copy of the file and the recipient. It does not reach into the recipient's device or retrieve data that has already left the platform. In practice, revocation is a combination of several actions that together close every path a recipient might use to access the file.
Full revocation addresses: the direct shared link, any named-user permissions, the password on the link, inherited folder access, and any secondary links that point to the same resource. Partial revocation — removing the link but missing the folder — is the most common failure mode.
Link Revocation
The direct action: delete the shared link in the sharing dialog. On Google Drive, open the file, click Share, remove the link under "General access." On OneDrive, open the file, click Share, open Manage access, and delete the link entry. On Dropbox, open the file's share options, go to Links, and delete.
The next time someone opens the URL, they will see an error. If someone is actively viewing the file in their browser, they may continue to see rendered content until the next refresh, because the platform generally does not force-close an active session.
Permission Removal for Named Users
If the file was shared with specific named users (as opposed to or in addition to a link), remove them individually in the sharing dialog. Named permissions persist even if the link is deleted — a user who was granted access by email can still open the file through their own account.
On SharePoint and OneDrive, the Manage Access view shows every user with explicit access. On Google Drive, the sharing dialog lists each named person. On Dropbox, the Members tab for the shared file lists everyone with access.
Password Rotation for Protected Links
If the link was password-protected, rotating the password invalidates the old one. This is useful when you want to keep the URL working but exclude the current holder of the password. For most scenarios, revoking the link entirely is simpler and avoids ambiguity about who holds which version of the password.
Removing External Guests
External guests often accumulate access across multiple files and folders. Removing them from one file does not remove them from the organization. The platforms expose guest-management tools: Entra ID (Microsoft 365) lists all guest users and allows bulk removal; Google Workspace has an external sharing report in the admin console; Dropbox Business lists external collaborators in the admin area.
For engagement closeouts, remove the guest from every scope they touched: shared folders, individual files, workspace invitations. The audit after the fact catches anything missed.
Disabling Public Links Site-Wide
If the file ever had an "anyone with the link" share, revoking the current link does not necessarily prevent a future user from recreating one. Admins can set an organization-wide policy that restricts public link creation to specific users or disables it entirely. For sensitive folders, this is a sensible default. The parent guide covers organization-wide policy choices in more detail.
File Replacement vs Deletion
If you want to keep the URL stable but change the content (for example, replace an outdated version with a current one), file replacement is better than deletion. On Google Drive, upload a new version through the three-dot menu on the file. On Dropbox, use the "Replace file" option. The URL remains stable, so anyone with the link now sees the new content.
Deletion is appropriate when the file should no longer exist in your workspace at all. On most platforms, deleted files move to a trash state for 30 days before permanent removal, during which they remain restorable but are not accessible through the previous share links.
What You Cannot Recover: Downloaded and Cached Copies
Revocation cannot retrieve a copy that has already landed on the recipient's device, nor can it reach into their email, messaging apps, or local backups. If the file was downloaded, it is a copy under the recipient's control. This limit is worth stating explicitly in internal communication about revocation — otherwise users assume "revoked" means "erased everywhere."
The implication is that revocation is most effective when combined with view-only sharing from the start. If downloads were disabled during the sharing lifetime, revocation ends access cleanly; if downloads were allowed, revocation ends live access but leaves local copies intact.
Verifying Revocation in the Audit Log
The verification step closes the loop. After revoking, attempt to open the link yourself from an incognito browser or a different account. You should see an access-denied response. Then check the audit log for subsequent access attempts from the recipient — successful attempts indicate incomplete revocation and require more investigation (usually inherited folder permissions you missed).
For engagements where revocation is formal, record the verification: date, who performed it, test result, log confirmation. For the broader topic of access logging, see how to track shared file access.
Per-Platform Revocation Steps
| Platform | Where to revoke a link | Where to view guests |
|---|---|---|
| Google Drive | File > Share > General access | Admin Console > Reports > External sharing |
| OneDrive / SharePoint | File > Share > Manage access | Entra ID > Users > Guest users |
| Dropbox Business | File > Share > Link settings | Admin Console > Members > External |
UI paths change over time. If a menu location differs from what is listed here, check the platform's current support documentation. The underlying actions — delete link, remove users, rotate password, review inheritance — remain the same regardless of UI changes.
Revocation Checklist
- Delete the direct shared link.
- Remove each named user who had explicit access.
- Rotate or clear any password on the link.
- Check the parent folder for inherited permissions and remove if necessary.
- Confirm no secondary shared links point to the same file.
- Attempt to open the link from an incognito browser — confirm access denied.
- Review the audit log for new access attempts over the next 24 hours.
- Record the revocation in the engagement or incident file.
For engagements that end with a specific closeout, add the revocation checklist to the project's closeout runbook so it becomes routine rather than an afterthought. The broader external access audit process is covered in how to audit external file sharing and guest access.
Frequently Asked Questions
Yes for new access attempts — the next time they try to open the link, they will get an error. If the recipient is currently viewing the file in their browser, they may continue to see the content until they refresh. The platform generally does not force-close an active session mid-view. For hard revocation that cuts an active session, you may need to delete the file or move it, depending on the platform.
About the Author: Mohamed Siraj
Mohamed is the founder of SecureTools.live. He leads the team in building secure, compliant, and privacy-first directory tooling for software teams, finance professionals, and enterprise security leaders worldwide.