Construction file sharing: how to share project files with subcontractors safely

A general contractor may send one bid set to 40 trade partners, then share revised drawings, RFIs and submittals with a dozen of them for the next year. The fastest way to handle that construction file sharing in Microsoft 365 is an open link anyone can use. It is also the one way of sharing your firm cannot audit, limit to a person or reliably shut off when the job closes.

Why is construction file sharing with subcontractors a risk?

Project files reach far more outside people than most firms track. Each bid package, drawing revision and change order that goes out as an open link can be forwarded, posted to a plan room or left in a sub's inbox long after the job ends.

Those files carry real exposure: site plans, security and access layouts for client facilities, pricing, and the contact and payment details attackers use for bank change fraud. If an owner asks who saw their drawings, an open link leaves you without an answer, even when a subcontractor was the one who forwarded it.

Are Anyone links safe for sharing files with subcontractors?

No, not for project files you need to control. Anyone links work for whoever holds them, with no sign-in. Microsoft describes an Anyone link as "a transferable, revocable secret key," and states that people using one "don't have to authenticate, and their access can't be audited" (Microsoft Learn).

For a subcontractor relationship, that means:

• A link sent to an estimator can be forwarded to anyone, including a competitor or an attacker who has taken over the estimator's mailbox.
• You cannot tell who opened the file, only that the link was used.
• Download controls you set for unmanaged devices do not apply. Microsoft notes that people with an Anyone link "will be able to download the item," and advises disabling Anyone links on sites where you use those controls (Microsoft Learn).

What should you use instead of Anyone links?

Use "Specific people" links for subcontractors. Microsoft describes a Specific people link as "a nontransferable, revocable secret key": it works only for the people named when the file is shared, the recipient must authenticate as that person, and the link does not work if anyone else opens it (Microsoft Learn).

Subcontractors do not need Microsoft 365 for this. When your tenant allows new and existing guests, a recipient can sign in with a work or school account, a Microsoft account, or a one-time verification code sent to their email (Microsoft Learn). A small trade partner with a Gmail address can still open the file, and you can still see that it was them.

For a sub who will be on the job for months, a per-project site with guest access is cleaner than file-by-file links. We cover that setup in how to give subconsultants access to one project folder and how to manage contractor identities.

Which SharePoint external sharing settings should you change?

Set the defaults so staff share safely without having to think about it. In the SharePoint admin center, Microsoft lets you set these for the whole organization, and each site can be set the same or more restrictive, never more permissive (Microsoft Learn):

• External sharing level. Set the organization to "New and existing guests" so every outside recipient signs in or uses a code. Because site settings can only be stricter than the organization setting, Anyone links on even one site require the organization level to stay at Anyone. In that case, set every other site to New and existing guests.
• Default link type. Under file and folder links, set the default to "Specific people" so the first option a project manager sees is the safe one.
• Anyone link limits. Where Anyone links stay on, require them to expire after a set number of days and restrict them to view only.
• Domain lists. Allow sharing only with your approved subcontractor domains, or block domains you never work with. Microsoft supports up to 5,000 domains in the list.
• Who can share externally. Limit external sharing to a security group, such as project managers and estimators, so not every employee can send files outside.
• Guest expiration. Set guest access to expire automatically after a set number of days, so access you forget about still ends. Site owners can extend it for active subs (Microsoft Support).

Can you stop subcontractors from downloading drawings?

Yes, for people who sign in. SharePoint can give users on unmanaged devices browser-only access, with "no ability to download, print, or sync files," and the setting can be applied to a single site (Microsoft Learn). Microsoft notes that people outside the organization are affected when you use this control.

That fits review sets and owner documents a sub needs to read but should not keep. It does not fit trades that must print sheets or import files into estimating software, so apply it to the sites where it matters instead of the whole tenant. It also does not cover Anyone links, so turn those off on the same site.

How do you find the open links already out there?

Start with a report, then clean up project by project. If your firm has SharePoint Advanced Management, the data access governance sharing links report lists the 100 sites where users created the most Anyone links, the most organization-wide links and the most Specific people links shared externally over the last 30 days. You can download it as a CSV, and Microsoft recommends running activity reports like this monthly (Microsoft Learn).

Without that license, site owners can check sharing on project files and folders from the Manage access panel. Either way, the goal is a short list of active projects with open links, and a decision on each: replace the link, set an expiration or remove it.

CIS Safeguard 6.2 calls for a process, preferably automated, to revoke access upon termination, rights revocation or role change (CIS Controls). Project closeout is the natural trigger for subcontractors.

What changes when drawings contain CUI?

When drawings contain Controlled Unclassified Information, an open link is harder to defend. NIST SP 800-171 Rev. 2 requirement 3.1.22 calls for controlling CUI posted or processed on publicly accessible systems, and requirement 3.1.1 limits access to authorized users (NIST). A link that works for anyone who has it does not limit access to authorized users.

For those projects, keep CUI files in the environment you use for CUI, turn Anyone links off at the site level and share only with named, authenticated users. Primes also pass requirements down to their trade partners, which we cover in how primes check CMMC flow down requirements. The counsel review list below covers what to check in your own subcontracts.

What should AEC firms do about subcontractor file sharing this quarter?

Pick the settings, then clean up the projects that matter most.

• Change the organization default link type to Specific people.
• Turn Anyone links off on every site that holds client facility, security or CUI drawings.
• Where Anyone links remain, require expiration and view-only access.
• Restrict external sharing to the staff who send bid packages and project files.
• Turn on guest access expiration for project sites.
• Run a sharing report, or have site owners review their active projects, and close out links on finished jobs.
• Add "remove subcontractor access" to your project closeout checklist.
• Tell project managers and estimators which link type to use, with a one-page example.

What should your counsel review before you share CUI drawings with trade partners?

Do this review when a prime sends a subcontract that includes DFARS 252.204-7012, and before the first CUI drawing goes to a trade partner. Bring the documents listed with each item.

• Flow-down to your subs. DFARS 252.204-7012(m) requires the clause in subcontracts for operationally critical support or whose performance will involve covered defense information (eCFR). Decide which trade partners that covers. Bring your subcontract with the prime and the list of subs who will receive drawings.
• Where the files live. DFARS 252.204-7012(b)(2)(ii)(D) requires an external cloud service provider that stores, processes or transmits covered defense information to meet security requirements equivalent to the FedRAMP Moderate baseline (eCFR), and a December 2023 DoD CIO memo sets what equivalent means (DoD CIO). Decide whether the Microsoft 365 environment you share from meets it. Bring your Microsoft 365 subscription details and the provider's FedRAMP documentation.
• Which files count as CUI. NIST SP 800-171 Rev. 2 requirement 3.1.22 covers CUI posted or processed on publicly accessible systems (NIST). Decide which drawing sets are CUI under your contract. Bring the contract's CUI markings or the prime's guidance.

How s90 helps

s90 manages Microsoft 365 for AEC firms across Los Angeles and Orange County, including the sharing settings, guest controls and project-site structure that limit subcontractor access to the files they need. We can review where open links exist today, set safer defaults without slowing your bid process, and build closeout steps your project teams will actually follow. If subcontractor file sharing has grown past what anyone tracks, we are glad to walk through what your next project could look like.