External Access Review Kit
Find outdated sharing grants and record what you actually removed.
For: Workspace owners and administrators reviewing document access
- Inventory direct invitations, groups and public links because a person may have more than one access route.
- Choose Keep, Reduce or Remove for each grant based on its current purpose and owner approval.
- Removing a group member is only one step; check whether a direct invitation still provides access.
- Close the review with verification evidence or an exception that names the responsible owner.
01 / Practical guide
Start with access routes, not only people
Inventory the routes that grant access rather than listing people alone.
An external access review checks whether people outside your organisation still need access to shared documents. The review must consider how access is granted: direct invitations, groups, parent folders, public links and other system-specific routes. Removing one invitation may leave another route active.
- List direct invitations
- Identify group access
- Find unrestricted links
- Assign grant-removal owners
- Verify the resulting access
Start with access routes, not only people
Bring the essential details together before work begins.
Read the practical details
Define the scope before collecting records. Choose a workspace, project or document collection and identify the administrator who can inspect it. Record the review date and any limitations in the inventory. A report from one system does not establish what exists in every other storage location.
Collect the resource, audience, permission, business purpose, owner and access route. Avoid storing private document contents in the inventory. Access records can themselves reveal sensitive relationships, so restrict the worksheet to the review team.
Do not assume an export is complete. Some reports represent groups without listing each member, or omit certain link types. Compare the report with sharing settings and group membership where appropriate. Mark unknown coverage openly rather than labelling an incomplete list a clean audit.
02 / Practical guide
Make a decision for each grant
Record the business purpose and decision for each grant.
Ask the resource owner whether the audience still has an approved purpose. Choose Keep, Remove, Reduce or Needs clarification. A quiet account is not automatically unnecessary, and a recent access event does not automatically establish approval. The business owner should explain the reason.
Make a decision for each grant
Follow the work in a clear sequence.
Read the practical details
For retained access, record the scope and next review point. An active adviser may need the current project folder but not every historical client record. If permissions are broader than the task, reduce the scope and verify the change.
Where the owner cannot confirm the purpose, follow your organisation’s escalation process. Do not casually remove access that could interrupt a critical workflow without understanding dependencies. Conversely, do not leave an unexplained exposure open indefinitely just because the original owner has left.
Review unrestricted links separately from named recipients. An audience described as “anyone with the link” is not a known list of individuals. Decide whether that audience is appropriate for the content, and record what action is possible in the actual system.
Copy and customise this template
Ready-to-use templateReview scope: [workspace or collection] Review date: [date] Coverage limitations: [known gaps] Access route: [direct / group / parent / public link] Business owner decision: [keep / reduce / remove / clarify] Implementation action: [change and administrator] Verification: [method, result and date] Exception: [reason, owner and next review]
03 / Practical guide
Use the example to find hidden follow-up work
Use the contractor and public-link example to locate follow-up checks.
The former contractor in ACC-01 has group-based access. Removing a direct file invitation would not address that grant. The administrator needs to inspect the group and any other relevant routes. The row remains Action required until the change is made and checked.
Use the example to find hidden follow-up work
Use a realistic example to show what changes.
Read the practical details
ACC-02 is an adviser with a current purpose. Keeping access is a deliberate decision, not a failure to act. Record the approval and the next review point so it does not become an unexplained permanent grant.
ACC-03 is an old public presentation link with no current purpose. The owner removes the link and tests it without the owner session. That check supports a conclusion about the tested route. It does not prove no independent copies exist elsewhere.
Use separate fields for Decision, Action and Verification. A completed decision is not a completed removal. Keep evidence references short: an administrator change record or dated permission check is more useful than copying unrelated logs into the worksheet.
| Access ID | Resource | Audience | Access route | Purpose | Decision | Action owner | Verification |
|---|---|---|---|---|---|---|---|
| ACC-01 | Project folder | Former contractor | Group membership | Project finished | Remove | Workspace administrator | Check group and folder access |
| ACC-02 | Current report | Approved adviser | Named invitation | Active engagement | Keep until review | Document owner | Confirm audience and expiry |
| ACC-03 | Old presentation | Unrestricted audience | Public link | No current purpose | Remove link | Document owner | Test link without owner session |
Choose the next action
| Situation | Action | Outcome |
|---|---|---|
| Former contractor still in a group | Remove the grant and check other access routes | Project closure is reflected in permissions |
| Active approved adviser | Keep scoped access with a review point | Useful access remains accountable |
| Old public presentation link | Disable it and test without the owner session | The intended link is no longer public |
04 / Practical guide
Close the review with evidence and exceptions
Verify implementation and document approved exceptions.
After making changes, repeat the relevant access checks. Review the direct grant, group membership, inherited scope and known public routes within the agreed review boundary. Where a representative recipient test is feasible, use approved test identities and harmless content.
Close the review with evidence and exceptions
Verify the exact conditions that matter before closing the work.
Read the practical details
If an action cannot be completed, record the reason, accountable owner and review date. A technical limitation or legal retention requirement needs an explicit exception, not a silent omission. Keep the exception visible in the handover summary.
Summarise counts by decision and verification state. Do not describe the workspace as secure simply because every row was reviewed. The inventory may have coverage limits, and controls need ongoing operation. State exactly which workspace and access routes were checked.
This kit supports a manual review. It does not connect to accounts, discover permissions automatically or revoke access. Use your approved administration tools for implementation, and retain the review record in an appropriate location.
Your completion check
Operational completion verification items
These are the only interactive checkboxes. Selections stay in this page session.
Use the worksheet
Interactive Worksheet Record
Fill one record per task. Work stays in this page session; export before closing.
Do not enter passwords, raw account details or confidential document contents.
05 / Practical guide
Answers before you close an access review
Review one completed project before expanding to the whole workspace.
Is deleting a person’s account enough?
It depends on the system and access route. Shared identities, public links, saved copies and other memberships need separate consideration.
Should I remove every external user?
No. Retain justified access with an owner and review point. The purpose is appropriate access, not an arbitrary zero count.
Does a report show everyone who can open a file?
Not always. Check its documented scope and exclusions. A report can be useful without being comprehensive.
Can revocation delete downloaded copies?
Generally it controls future access through the revoked route. It does not retrieve files already saved by recipients.
What should I review first?
Choose one completed project, list its known external grants and ask the owner to justify each one. Remove or reduce approved targets, then record what was actually verified.
Answers before you close an access review
Show who owns each part of the work.
Related guides & articles
Data Room Audit Trail Requirements: Events, Evidence, and Limits
Understanding compliance, event logging, and verification of user access activities.
M&A VDR Permission Matrix: Roles, Rights, and Release Controls
Role-based permission architecture for multi-stakeholder diligence environments.
Clean-Team Data Room for M&A: Access, Workflow, and Controls
Restricting sensitive competitive and pricing data to approved clean-team members.