How do you revoke a customer's access to your security evidence?

To revoke a customer's access to your security evidence, list every place the files were shared, remove named users and groups, expire or regenerate any open links, then record the date and confirm in writing. The hard part is not the removal. It is knowing where the access exists.

Start with an inventory, not a delete button

Access to evidence tends to spread over time. A customer gets an SBOM by email in the sales cycle, a portal login at signing, a shared folder for their auditor, and a link in a ticket. Before you can revoke anything, you need to know all of those.

A sharing register fixes this. One row per customer, with the documents sent, the channel, the recipients and the expiry. If you do not have one yet, build it from your mail, your file sharing tool and your ticketing system. See track what you have shared with each customer.

Offboarding steps

1. Find the end date. Use the contract end date, plus any agreed wind down period. Do not guess.
2. Remove named access. Delete the customer's users, guest accounts and groups from portals and folders.
3. Handle open links. Links that anyone can open cannot be tied to a person. Expire them, or rotate the file to a new location so the old address stops working.
4. Cancel automated sends. If SBOM updates or advisories go out by a mailing list or webhook, remove the customer from it.
5. Check integrations. Look for API tokens or service accounts issued to the customer, and revoke them.
6. Record it. Note who did the work, the date, and what was removed.
7. Confirm. Send a short note: access is closed as of a date, and documents already received remain under whatever confidentiality terms the contract states.

That last point matters. Revoking access prevents new downloads. It does not recall a file already sitting in someone's mailbox. Treat retention and return of copies as a contract topic for your legal team, not something a control can fully enforce.

What platform controls help

Platform documentation describes the building blocks. In SharePoint, for example, Microsoft states that to stop sharing with guests you remove their permissions from the item or remove them as a guest in your directory. For Anyone links, you go to the file or folder and delete the link. Guest access can also be set to expire automatically after a number of days.

That last setting is worth using from day one. If every external guest expires by default, offboarding becomes the exception handler instead of the only line of defence.

Make it routine

Tie revocation to an existing trigger. Many teams already run a customer offboarding checklist in their CRM or ticketing tool. Add one line: "Revoke evidence access and update the register." Then the work is done when the customer is marked closed, not when someone remembers.

For customers who stay but whose reviewers change, run a quarterly check instead. Ask the customer to confirm the current list of people who should have access, and remove the rest. This mirrors how access reviews work for your own systems.

Safeguard produces SBOMs and compliance evidence as exports, so you can regenerate a file at a new address when you need to retire an old link. A free scan shows the export format.

Quick check

Sources

• Manage sharing settings for SharePoint and OneDrive, Microsoft Learn
• Overview of external sharing in SharePoint and OneDrive, Microsoft Learn

Last reviewed: 19 October 2026.