Is there an automated way to clean up / bulk delete past sharing links without user intervention?

Yes—for OneDrive for Business, this can be automated without each user removing links manually. The Access Denied error usually means the script lacks access to that OneDrive site; being a tenant administrator doesn’t automatically grant access to every user’s files.

A supported approach is Microsoft Graph with an admin-consented application identity:

1. Enumerate the target users’ drives and items.
2. Retrieve each item’s permissions:
   GET /drives/{drive-id}/items/{item-id}/permissions
3. Select permissions containing a link facet, then delete only those matching your cleanup policy:
   DELETE /drives/{drive-id}/items/{item-id}/permissions/{permission-id}

The deletion endpoint supports the application permission Files.ReadWrite.All, which is broad. Use a controlled automation identity and review whether a narrower, explicitly scoped permission model meets your requirements.

Start with a report-only run and a small pilot. Removing a link stops access through that link, but doesn’t remove access granted separately through groups or direct permissions. Also, “old” doesn’t necessarily mean unused—these permission records don’t provide a universal last-used date.

You can work with item and permission metadata without downloading file contents, but the granted access still needs privacy and governance approval. Microsoft documents the operation here: Delete a sharing permission.