Forum Discussion
Is there an automated way to clean up / bulk delete past sharing links without user intervention?
Hello everyone,
I'm currently dealing with sharing link management across SharePoint, Teams groups, and OneDrive in our tenant.
While I know that we can easily script the listing and deletion of sharing links for SharePoint sites and Teams groups using PowerShell, doing the same for individual OneDrive personal sites returns an "Access Denied" error when using an admin account.
I completely understand why this is designed this way: to protect users' personal data privacy and prevent admins from snooping into personal files.
However, looking at the user side in OneDrive Web under Shared > By me, a user can see a list of shared items, but when selecting multiple items in bulk, the sharing management options disappear (they only appear when selecting a single item). This means users have to review and clean up their shared links one by one, which is not realistic to ask of them.
While we can configure global admin policies (like automatic expiration for Anyone links) to prevent future link accumulation, past sharing links remain persistent.
My question is : Is there an existing automated method, admin procedure, or tool that allows cleaning up or bulk-deleting existing sharing links inside users' OneDrive accounts, without violating privacy or requiring manual one-by-one removal by the end users?
Thank you for your insights!
1 Reply
Yes—for OneDrive for Business, this can be automated without each user removing links manually. The Access Denied error usually means the script lacks access to that OneDrive site; being a tenant administrator doesn’t automatically grant access to every user’s files.
A supported approach is Microsoft Graph with an admin-consented application identity:
- Enumerate the target users’ drives and items.
- Retrieve each item’s permissions:
GET /drives/{drive-id}/items/{item-id}/permissions - Select permissions containing a link facet, then delete only those matching your cleanup policy:
DELETE /drives/{drive-id}/items/{item-id}/permissions/{permission-id}
The deletion endpoint supports the application permission Files.ReadWrite.All, which is broad. Use a controlled automation identity and review whether a narrower, explicitly scoped permission model meets your requirements.
Start with a report-only run and a small pilot. Removing a link stops access through that link, but doesn’t remove access granted separately through groups or direct permissions. Also, “old” doesn’t necessarily mean unused—these permission records don’t provide a universal last-used date.
You can work with item and permission metadata without downloading file contents, but the granted access still needs privacy and governance approval. Microsoft documents the operation here: Delete a sharing permission.
