Quick wins for a faster PC:
Scan for outdated or missing drivers - takes under a minuteDriver Scan →Clear out junk files and repair common Windows errorsFree Scan →Fix the driver behind crashes, sound loss and screen glitchesFind Drivers →iTechGuides is reader-supported. When you buy through links on our site, we may earn an affiliate commission. As an Amazon Associate I earn from qualifying purchases. Learn more
Preventing leaks from cloud apps and shared files requires several controls working together: secure sign-ins, restrictive sharing defaults, identity-bound links, sensitive-data rules, regular access reviews, and fewer unnecessary copies. A link is an access grant, not merely a convenience. An “Anyone” link can be opened without authentication and forwarded, while a “Specific people” link limits access to named recipients who authenticate. Start by inventorying where sensitive files live, require multifactor authentication, make the least-permissive link type the default, restrict external collaboration to approved people or domains, and continuously remove stale access and duplicate files. Microsoft SharePoint and OneDrive provide well-documented examples, but their settings do not map one-for-one to every cloud service.
Why do cloud apps and shared files leak data?
Most exposure comes from ordinary features used without enough context: a broad link, an overprivileged guest, a compromised account, an unreviewed copy, or a sensitive file placed in a location designed for easy collaboration. Microsoft describes the underlying problem clearly: “Controlling access to data is necessary but insufficient in exerting control over data movement and in preventing inadvertent or unauthorized data leakage or loss.” Its Zero Trust data guidance treats access, classification, monitoring, and data-handling controls as complementary rather than interchangeable.
Use a layered model:
- Identity: make it difficult for an attacker to sign in as an employee, administrator, or guest.
- Sharing: grant access to the smallest audience, for the shortest practical time, with the least privilege.
- Data controls: identify sensitive material and warn, block, or isolate risky sharing.
- Lifecycle: review permissions, expire obsolete links, and remove copies that no longer have a business purpose.
- Human workflow: make the approved collaboration route convenient enough that users do not move files to unmanaged services.
No single setting can compensate for the others. Strong MFA does not make an unauthenticated public link safe, and disabling external sharing does not protect an account that an attacker can take over.
Crashes, No Sound, or Screen Glitches?
Random freezes, missing sound and display glitches usually trace back to one bad driver. Find and replace yours safely.Free scan · under a minutePC Slower Than It Used to Be?
A free scan shows the junk files, broken settings and background clutter dragging Windows down - then fixes them in one click.Free scan · Windows 10 & 11How do I find the cloud apps, files, and sharing paths that need protection?
Begin with an inventory. You cannot choose an appropriate sharing policy until you know which services hold sensitive information, who administers them, and how people currently exchange files.
#1 Best Overall
- Read Before You Buy — No Video Output: These adapters support charging and USB 2.0 data transfer, but cannot transmit video signals. Except for standard USB webcams (which use USB data only), they are not compatible with HDMI/DisplayPort cables, video-capable USB-C hubs, or docking stations with video output.
- Convert USB-A Ports to USB-C: Designed to connect USB-C earphones, cables, flash drives, card readers, and other USB-C accessories to standard USB-A ports. Plug-and-play with no drivers or software required.
- Aluminum Alloy Housing: Built with a sturdy aluminum alloy shell that aids in heat dissipation and protects against daily wear and scratches. Designed to maintain a stable and secure connection.
- Compact & Travel-Friendly: The ultra-compact design allows the adapter to stay plugged into your device without blocking adjacent ports or adding bulk, reducing wear and tear on your original USB ports.
- 12-Month Warranty: Backed by a 12-month manufacturer warranty for peace of mind. Designed to meet strict quality control standards for reliable everyday performance.
Record the services and repositories
- List sanctioned file stores, collaboration suites, project-management tools, form systems, and business applications that accept uploads or expose documents.
- Identify personal drives, team sites, shared mailboxes, departmental folders, and external workspaces that may contain the same information.
- For each service, record the owner, administrator, data region or edition where relevant, external-sharing capability, audit availability, and retention requirements.
Classify what is at stake
Separate information that is safe for broad distribution from information that could harm people or the organization if exposed. Typical high-risk categories include identity data, payment details, credentials, health information, confidential contracts, source code, security reports, and unannounced business plans. Classification does not have to be perfect on day one; it must be useful enough to drive different sharing rules.
Trace every route to an outside recipient
Document guest invitations, public or “anyone” links, approved partner domains, email attachments, exports, downloaded copies, synchronised folders, and integrations that copy content into another service. Note whether each route requires sign-in, records the recipient identity, supports expiry, and permits editing. This map reveals where the real exposure is rather than where administrators assume it is.
How do I secure the accounts that can access sensitive files?
Require multifactor authentication (MFA) for every account that can reach sensitive repositories, prioritising administrators and users who handle the most confidential data. CISA says, “Businesses should aim to use a phishing-resistant MFA method.” A physical security key is one example; it plugs into or taps a device and is designed to resist phishing. Read CISA’s implementation guidance for service support and recovery considerations at Require Multifactor Authentication.
The Tool Desk
Outbyte Driver Updater FREEScan for outdated or missing drivers - takes under a minuteDriver Scan →Outbyte PC Repair FREEClear out junk files and repair common Windows errorsFree Scan →Set an enrollment and recovery policy
- Require enrollment before granting access to sensitive repositories or administrative roles.
- Prefer a phishing-resistant method when the cloud service supports it, while retaining a controlled recovery method for lost devices.
- Register more than one approved factor where policy permits, but protect backup factors as carefully as the primary one.
- Test account recovery with help-desk staff so that an attacker cannot defeat MFA simply by persuading support to reset it.
- Remove factors and sessions when a user leaves, changes role, or loses a device.
MFA reduces account-takeover risk; it does not change the audience of a link. A file shared with anyone who has the URL may remain accessible to a person who never authenticates, so identity protection and link controls must be configured together.
What is the difference between Anyone, organization, and Specific people links?
The link type determines who can redeem an access grant, whether the recipient must authenticate, and how much control you retain if the URL is forwarded. In SharePoint and OneDrive, Microsoft documents the following patterns in Plan sharing and collaboration options and Plan and deploy a file collaboration environment.
| Link or policy | Recipient authentication | Scope and forwarding risk | Best use | Important limitation |
|---|---|---|---|---|
| Anyone | Not required | Anyone who obtains the URL can use it; it can be forwarded outside the intended audience. | Content suitable for broad public or low-risk distribution. | In the specific security-group configuration guidance, Microsoft says an Anyone link cannot identify who accessed the item. Use view-only and expiry constraints where available. |
| People in your organization | Organizational account required | People inside the organization who obtain and redeem the URL can access it; it does not automatically grant access to every employee. | Internal collaboration where an authenticated workforce is the boundary. | The link can still be passed internally, so it is not a substitute for recipient-specific permission. |
| Specific people | Named recipients authenticate | Access is tied to the people selected for the share, reducing the impact of forwarding. | Sensitive files and external collaboration that needs identity-bound access. | Recipient changes require a new permission decision; guests may need an invitation and sign-in. |
| External-sharing policy | Depends on the chosen link and guest model | Can limit sharing to existing guests, approved groups, allowed domains, or other administrator-selected boundaries. | Enforcing a consistent organization or site-level guardrail. | Overly strict settings can push users toward unmanaged alternatives; policy must match real partner workflows. |
Choose the narrowest option that still lets the recipient complete the work. If you cannot name the recipients or require their accounts to authenticate, treat the file as appropriate for anyone who receives the link and apply a lower sensitivity classification.
Rank #2
- 5-in-1 USB-C Hub: Experience comprehensive connectivity featuring a Power Delivery input, two USB-A 2.0 ports, a USB-A 3.0 port, and an HDMI port. (Note: The USB-C power delivery input port is only for connecting an external wall charger to power your laptop and cannot power peripheral devices.)
- 90W Pass-Through Charging: Achieve optimal charging with 90W pass-through power to your laptop, supported by a total input of 100W, with the hub reserving 10W for operational efficiency. (Note: Wall charger not included.)
- Quick Data Transfers: Accelerate your productivity with rapid data transfers using a high-speed 5Gbps USB 3.0 port and two 480Mbps USB 2.0 ports.
- 4K HDMI Display: Enhance your visual experience with a hub capable of delivering 4K resolution at 30Hz in both mirror and extend modes. Please note that this hub is compatible with MacBook (macOS 12 and newer), Windows 10 and 11, ChromeOS, and laptops equipped with DP Alt Mode and Power Delivery. Note: This device is not compatible with Linux.
- What You Get: Anker USB-C Hub (5-in-1, 4K HDMI), welcome guide, 18-month warranty, and our friendly customer service.
How do I prevent “anyone-with-the-link” access?
Change the default link type before relying on user judgment. For sensitive material, make a named-recipient link the normal choice and remove or tightly restrict Anyone links at the organization or site level.
Free tools Windows power users keep installed
One-click scans. No signup required.
For a file owner sharing from SharePoint or OneDrive
- Open the file or folder’s Share command.
- Open Link settings (the wording can vary by tenant release).
- Select Specific people for sensitive external sharing, or the organization-only option for internal work.
- Enter the intended recipients rather than copying a general link.
- Set Can view unless editing is required. Do not grant edit rights merely because a recipient may need to download a copy.
- Use an expiration date when the collaboration has a defined end, and send the invitation through the service so the recipient must authenticate.
- Before sending, verify the recipient list, site or folder, permission level, and whether the link can be forwarded.
For administrators
Use the organization-level and site-level sharing controls to set the most restrictive practical default. Microsoft’s guidance allows restrictions based on guest status, allowed domains, sharing groups, and link settings. Start with a policy that blocks Anyone links for sensitive locations, then create a documented exception process for content that genuinely needs broad distribution.
Do not assume that changing a default retroactively fixes old links. Review existing links and permissions separately; a previously created broad link can remain an access path until it is removed or expires.
How do I stop sharing files with people outside my organization without breaking collaboration?
External sharing does not have to be all-or-nothing. Restrict who can invite guests, which domains are allowed, which groups may share, and which sites may accept external users. Keep a controlled route for approved partners so employees do not create shadow workspaces.
Use a graduated policy
| Business situation | Practical boundary | Review trigger |
|---|---|---|
| Highly sensitive or regulated material | Separate site or repository with external sharing disabled, or limited to named existing guests. | Any request for a new guest or exception. |
| Established partner work | Allow authenticated guests from approved domains or groups; require specific-people links. | Partner contract end, role change, or inactive account. |
| Routine internal collaboration | Organization-only links and internal groups; view-only by default for distribution. | Team membership or project closure. |
| Public or broad distribution | Anyone link only for content classified as suitable for public access, with view-only and expiry where available. | Content update, takedown request, or classification change. |
Microsoft notes that actual tenant settings differ and that external sharing is enabled by default in some documented environments. Confirm the live configuration rather than assuming a default. Its guidance is at Manage sharing settings for SharePoint and OneDrive in Microsoft 365.
OneDrive cannot be configured more permissively than SharePoint, and the most restrictive applicable setting governs. Check both organization-wide and site-level restrictions before troubleshooting why a user cannot share or why a link is broader than expected.
Rank #3
- Sleek 7-in-1 USB-C Hub: Features an HDMI port, two USB-A 3.0 ports, and a USB-C data port, each providing 5Gbps transfer speeds. It also includes a USB-C PD input port for charging up to 100W and dual SD and TF card slots, all in a compact design.
- Flawless 4K@60Hz Video with HDMI: Delivers exceptional clarity and smoothness with its 4K@60Hz HDMI port, making it ideal for high-definition presentations and entertainment. (Note: Only the HDMI port supports video projection; the USB-C port is for data transfer only.)
- Double Up on Efficiency: The two USB-A 3.0 ports and a USB-C port support a fast 5Gbps data rate, significantly boosting your transfer speeds and improving productivity.
- Fast and Reliable 85W Charging: Offers high-capacity, speedy charging for laptops up to 85W, so you spend less time tethered to an outlet and more time being productive.
- What You Get: Anker USB-C Hub (7-in-1), welcome guide, 18-month warranty, and our friendly customer service.
How can I prevent sensitive files from being shared externally?
Combine classification with data-loss-prevention (DLP) rules. Classification gives the file a sensitivity context; DLP can detect sensitive information and warn or block an unsafe action. Microsoft’s example policy for SharePoint and OneDrive is expressly hypothetical, so test rules with representative data before enforcing them broadly. See Help prevent sharing sensitive items via SharePoint and OneDrive with external users.
Separate the highest-risk material first
Put highly sensitive files in locations where external sharing is disabled or more restrictive. This creates a structural boundary that remains in place even if an individual owner chooses a broad link elsewhere. Keep ordinary project material in a collaboration-friendly location so the restrictive area does not become a reason to bypass policy.
Build DLP rules in observation mode
- Define the sensitive information types or labels that matter to your organization.
- Identify where those items are stored and which legitimate external workflows exist.
- Start with audit or user-notification actions so you can measure false positives and missed cases.
- Test files with realistic formats, legacy documents, scans, and deliberate non-sensitive examples.
- Tune thresholds, exceptions, and administrator escalation before blocking.
- Enforce blocking for the clearest high-risk cases, while retaining a documented business-justification path where appropriate.
- Review alerts and policy matches regularly; a rule that is never tuned will either frustrate users or be ignored.
Microsoft’s Zero Trust guidance emphasizes controlling data movement as well as access. A DLP alert is not a substitute for removing a guest or revoking a link; it is an additional decision point that can stop or surface an unsafe action.
What’s actually slowing this PC down?
Pick the symptom - the matching free tool is one click away.
How do I make shared files view-only?
Use the least permission that completes the task. In the file’s sharing dialog, select the link settings, choose Can view, and disable editing before sending the invitation. For folders, remember that folder-level edit permission can allow recipients to modify, rename, move, or delete multiple files; share a single file when that is all the recipient needs.
- Use view-only for announcements, reference documents, proofs, and deliverables.
- Grant edit access only to named collaborators who must change the source.
- Do not assume download prevention is absolute; a viewer may still capture information by other means. Treat view-only as a reduction in modification risk, not a guarantee against copying.
- After a project ends, remove edit rights rather than leaving the link active indefinitely.
How often should I review guests, links, and file permissions?
Review access on a schedule proportionate to sensitivity and whenever a project, contract, or employee role changes. A review should cover direct permissions, group membership, guest accounts, inherited access, active links, and recent sharing activity.
A practical review checklist
- Export or inspect the people and groups with access to each sensitive site or folder.
- Confirm that every guest still has a business owner, a current purpose, and an active relationship.
- Remove people who changed roles, left the project, or no longer need access.
- Find Anyone and organization-wide links in sensitive locations and replace them with named-recipient links or revoke them.
- Check whether edit rights can be reduced to view-only.
- Review sharing and download activity for unusual recipients, times, or volumes, then follow your incident process for anomalies.
- Record the reviewer, date, decisions, and exceptions so the next review has an auditable starting point.
What happens when external sharing is disabled and re-enabled?
Do not treat a temporary shutdown as permanent revocation. CISA’s Microsoft baseline guidance warns that turning external sharing off and later turning it back on can restore guest access. Before changing the policy, identify affected sites and guests; after re-enabling it, verify which accounts and links are active. The relevant draft baseline is available at Microsoft OneDrive for Business M365 Minimum Viable Secure Configuration Baseline Draft v0.1.
Rank #4
- Dual Converters, Infinite Potential：Includes 2× USB C male to USB A female adapters and 2× USB A male to USB C female adapters. Perfect for a wide range of uses—tablets with Bluetooth keyboards, expand USB ports on macbook, and more. Two different converters for all your daily needs
- Next-Level 10Gbps & 3A Charging: No more slow 480Mbps, this usb to usb c adapter has a transfer speed of up to 10Gbps, allowing you to do more transferring in less time. This usb adapter fits both USB A and USB C charger, supporting up to 3A fast charging
- Upgraded Exquisite Craftsmanship: With an aluminum alloy housing and metal connector, the usbc to usb adapter is extremely durable and sturdy. Rigorously tested to withstand more than 10,000 times of plugging and unplugging, ensuring long-lasting performance
- Broad Compatible: The usb c to usb adapter widely supports all USB C/ USB A devices like laptops, tablets, cellphones, car chargers, and phone chargers. Such as compatible with MacBook Pro/Air 2023/2022, Thunderbolt 4/3 Devices,Apple MagSafe Watch 9/8/7/SE/Ultra, iPad Pro 2022/2021, Samsung Galaxy S23/S20/S10, and iPhone 17/16/15 Pro. Plug and play
- Please Note: To reach 10Gbps speed, keep the cable under 3.3 ft. For USB A Male to USB C adapters, try flipping the USB C connector. USB C Male to USB A adapters support bidirectional 10Gbps transfer within 3.3 ft
CISA also publishes an agency-oriented recommendation that “External sharing for SharePoint SHALL be limited to Existing guests or Only People in your organization.” Treat that statement as a government baseline, not a universal legal requirement; review the full SharePoint and OneDrive Secure Configuration Baseline alongside your organization’s obligations.
How do I reduce leaks caused by duplicate files?
Every downloaded, exported, synchronised, or emailed copy creates another place to protect. Prefer in-place collaboration when the workflow allows it, and make the authoritative location clear so people do not create parallel versions in personal drives or unmanaged services.
- Use one controlled working file or team location instead of emailing successive attachments.
- Share a view-only link to the current version when recipients do not need a local copy.
- Restrict export or download where the service and workflow support it, while recognising that technical controls cannot stop every form of capture.
- Apply retention and deletion rules to obsolete drafts, exports, and temporary workspaces.
- When a project closes, archive the required record in the approved location and delete working copies that have no continuing value or retention requirement.
Deletion must respect legal, regulatory, and contractual retention duties. “Keep everything forever” is not a leak-prevention strategy: it increases the amount of sensitive material exposed if an account or repository is compromised.
Independent reader supportYour contribution helps us test, update, and keep practical guides available for everyone.How do I train users to share files safely?
Give users a short decision they can apply at the moment of sharing: who needs access, do they need to authenticate, do they need to edit, and when should access end? Explain that a link is an access grant and that forwarding changes the audience.
Make the safe path easy to choose
- Set restrictive defaults so users do not have to remember an administrative policy for every share.
- Provide approved partner sites, guest-request forms, and support contacts that work quickly enough to be credible.
- Use plain-language prompts such as “Specific people,” “People in your organization,” and “Anyone with the link,” with a warning beside the broadest option.
- Train staff to verify recipients and permission level immediately before sending, not only when creating the file.
- Explain why unmanaged alternatives are risky and offer an approved replacement for common workflows.
Microsoft recognises that excessive friction can lead users to seek unmanaged alternatives. Measure rejected shares, exception requests, and shadow-storage reports; a policy that blocks legitimate work without a usable alternative will be bypassed.
Do these 3 things before closing this tab:
1Clear out junk files and repair common Windows errors2Fix the driver behind crashes, sound loss and screen glitches3Repair Windows errors before they cause bigger problemsWhat should I do when I find an exposed link or guest?
Contain the access path first, then investigate what was reachable. Revoke or replace the link, remove the guest or group permission, and reduce the file to view-only or move it to a more restricted location where appropriate. Preserve relevant audit records before they age out, identify the owner and recipients, and follow your organization’s incident, legal, and notification procedures.
Best Value
- 5-in-1 Connectivity: Equipped with a 4K HDMI port, a 5 Gbps USB-C data port, two 5 Gbps USB-A ports, and a USB C 100W PD-IN port. Note: The USB C 100W PD-IN port supports only charging and does not support data transfer devices such as headphones or speakers.
- Powerful Pass-Through Charging: Supports up to 85W pass-through charging so you can power up your laptop while you use the hub. Note: Pass-through charging requires a charger (not included). Note: To achieve full power for iPad, we recommend using a 45W wall charger.
- Transfer Files in Seconds: Move files to and from your laptop at speeds of up to 5 Gbps via the USB-C and USB-A data ports. Note: The USB C 5Gbps Data port does not support video output.
- HD Display: Connect to the HDMI port to stream or mirror content to an external monitor in resolutions of up to 4K@30Hz. Note: The USB-C ports do not support video output.
- What You Get: Anker 332 USB-C Hub (5-in-1), welcome guide, our worry-free 18-month warranty, and friendly customer service.
- If the link is an Anyone link, assume it may have been forwarded because no recipient authentication is required.
- If the account may be compromised, revoke sessions and reset credentials through the service’s approved process, then verify MFA factors and recovery information.
- Check related files and duplicate locations; closing one link does not close copies or another inherited permission.
- After containment, correct the default or policy that allowed the exposure and schedule a follow-up access review.
Which controls should I implement first?
Use this order when resources are limited. It addresses the highest-impact, broadly applicable weaknesses before adding more specialised automation.
- Map the environment: list sensitive repositories, owners, guests, link types, and external workflows.
- Protect identities: require MFA, prioritise administrators and sensitive-data users, and prefer phishing-resistant methods where supported.
- Change defaults: make Specific people or organization-only links the normal choice; limit Anyone links to content suitable for broad access.
- Constrain external collaboration: use approved guests, domains, groups, and restricted sites rather than a blanket policy that users cannot follow.
- Add data-aware controls: classify sensitive material and test DLP warnings or blocks before broad enforcement.
- Review and clean up: remove stale guests, privileges, links, and duplicate copies; verify the effect of any policy rollback.
- Reinforce the workflow: train users, publish a usable approved route, and measure exceptions and shadow sharing.
For platforms other than Microsoft 365, use the same control objectives but consult that provider’s current administrator documentation. Names such as “Anyone,” “organization,” “guest,” and “specific people” are not guaranteed to have identical behavior across services.
What are the important limitations to keep in mind?
- Cloud-provider defaults vary by tenant, edition, region, and policy history. Verify the live configuration.
- Microsoft’s SharePoint and OneDrive controls are implementation examples, not a promise that every cloud app offers the same link types or DLP behavior.
- CISA baselines are tailored to government environments, and the OneDrive minimum-viable document cited above is a draft. Use them as security guidance, then apply your own contractual and regulatory requirements.
- No control guarantees that a recipient cannot photograph, copy, or retype information. The goal is to reduce unauthorised access and make risky movement visible and harder.
- Changing a sharing policy may affect existing guests differently from new invitations. Test in a representative site and review access after every major policy change.
A defensible program therefore combines authentication, link and guest restrictions, classification and DLP, reviews, lifecycle deletion, and a collaboration process people can actually use. Each layer addresses a different way data can leave its intended boundary.
Frequently Asked Questions
Does MFA protect a file shared with an Anyone link?
No. An Anyone link does not require the recipient to sign in, so MFA on employee accounts does not authenticate someone who receives or forwards that URL. Replace the link with a named-recipient or organization-only link when the file needs an identity boundary.
Can I safely share a sensitive folder if every file inside is view-only?
Not necessarily. Folder-level access can expose multiple files and metadata, and view-only reduces editing without preventing screenshots, downloads where allowed, or forwarding of a broad link. Share the smallest individual item and audience that meets the task.
What should happen to guest accounts for completed projects?
Assign each guest an owner and an end date when the invitation is created. At project close, remove the guest or group membership, revoke active links, and check for copies in other repositories rather than merely disabling the person temporarily.
Is a security key enough to stop cloud data leaks?
A phishing-resistant security key can strengthen account authentication, but it does not change file permissions or link scope. Pair it with restrictive sharing defaults, sensitive-data rules, and periodic access reviews.
Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
