Microsoft Loop security settings: control sharing and access

Microsoft Loop security is controlled in two places: inside Loop, where you share a page, workspace, or component with specific people, and in Microsoft 365, where tenant-wide sharing rules decide what those shares are allowed to do. If you only change one side, you can still expose content by accident. The safest approach is to set the Microsoft 365 sharing boundaries first, then create Loop content with the narrowest sharing that still works for the team, and then verify access with a separate account.

What Loop security settings can you actually change?

Before you touch a share button, separate the controls that live in Loop from the controls that come from Microsoft 365.

Prerequisites

• A Microsoft 365 admin account, or access to the SharePoint and OneDrive admin settings that control sharing.
• Permission to manage the Loop page, workspace, or component you want to test.
• A second account for verification, plus a third account or browser profile that should not have access.
• If you plan to test external access, a guest account or approved external user.

Steps

1. Decide whether you are changing a page, a workspace, or a component.
2. Check the Microsoft 365 tenant settings first, because they set the outer limit for sharing.
3. Open the Loop item and review its current share list before you invite anyone else.

Loop gives you item-level sharing: you can invite people to a page or workspace, and you can choose who can edit or just view, depending on the item and the current tenant rules. Microsoft 365 controls the bigger boundary around that sharing. Those tenant settings decide whether users can share with people outside the organization, whether guests can access shared content, and how broadly links can be used.

That matters because Loop content is stored on Microsoft 365 services, not in a completely separate silo. In practice, a Loop page or workspace often depends on SharePoint and OneDrive permissions underneath. So if your Microsoft 365 sharing policy allows broad external access, Loop can reflect that. If those tenant settings are tight, Loop sharing is tight too, even if someone tries to create a wider link.

The short version is this: use Loop to assign the right people to the right content, and use Microsoft 365 admin settings to decide the outer limit of who can ever get in.

How sharing works for pages, workspaces, and components

A Loop page, a workspace, and a component do not behave the same way, even though they all feel shareable.

A shared page link gives access to one page. That’s usually the narrowest option when you want people to read or edit a specific note, plan, or checklist without opening the whole workspace.

A workspace invitation is broader. It can give people access to the container that holds multiple pages and related content, so use it only when the whole group should see the full set of material.

A reusable Loop component is trickier, because it can appear in places like chat or email while still pointing back to the source content. If a component is shared from a page that others can access, updates may be visible anywhere the component has been inserted. That makes it useful for live status items, but it also means you should treat it like linked data, not a detached copy.

Say you have a project team and one external contractor. If the contractor only needs the timeline, share the page that holds the timeline. If they need the whole project space, invite them to the workspace only after tenant sharing rules allow that. If you place a Loop component into a chat, remember that people may be able to follow it back to the source if they already have permission.

In practice

• Use a page share for the smallest audience that needs one item.
• Use a workspace share when people need the full set of pages and related material.
• Use a component when you want live content in another place, but remember it still points to the source item.

The settings that matter most in Microsoft 365 admin center

The controls that matter most are the ones that limit how content can be shared across the tenant. Start in the Microsoft 365 admin center and check the settings for SharePoint and OneDrive, because those services usually govern the storage and permission model behind Loop content.

Focus on these areas:

• External sharing: decide whether people can share with users outside your organization at all, and if so, how broadly.
• Guest access: confirm whether guests are allowed in your tenant and whether they can be invited into the content that Loop depends on.
• Link permissions: look for settings that control anonymous links, anyone links, or links that can be forwarded outside the company.
• Default sharing behavior: make sure the default doesn’t grant more access than you intend.

If your organization uses tighter SharePoint or OneDrive sharing than Loop appears to suggest, that’s expected. Loop typically follows the underlying Microsoft 365 policy. So if you want Loop to stay internal only, lock down external sharing at the tenant level first, then work outward from there.

If your admin policies are managed in a separate portal for SharePoint or OneDrive, use the same logic there: block or limit anonymous access, restrict guest sharing where possible, and review any policy that allows users to share content with people outside the org.

Where to change it

• Microsoft 365 admin center for tenant-level policy review.
• SharePoint admin settings for external sharing and link behavior.
• OneDrive admin settings for user-file sharing that can affect Loop storage and permissions.

What to check before you invite anyone outside the company

Before you bring in an external guest, check the inherited permissions first. A lot of exposure happens because someone shares a workspace or page that already includes broader access than they expected.

Look for these risk points:

• Old links that still work and point to the same content.
• Pages copied into a new location but carrying permission assumptions from the original.
• Workspace membership that is wider than the specific content really needs.
• Anonymous or anyone links that were created earlier and never removed.
• SharePoint or OneDrive settings that still allow external sharing even if your team thinks it’s blocked.

Removing access from a page or workspace does not always erase every copy, link, or downstream reference at the same moment. If content has already been copied or forwarded, you may need to review those locations too.

A safe pattern is to start with the smallest possible audience, then expand only if the business need really requires it. If you must invite someone outside the company, make sure the content they can reach is only the content they need, not the whole workspace by default.

How to confirm your Loop setup is secure

Use a quick verification pass after you change sharing settings. The goal is simple: confirm the intended people can open the content, and everyone else cannot.

1. Open the page or workspace as the owner and confirm the current sharing list looks right.
2. Check whether the item is shared as a page, a workspace, or a component, so you know exactly what access you are validating.
3. Use a second account that should have access, such as another internal user or approved guest, and confirm the content opens with the expected permissions.
4. Use a third account that should not have access, or a private browsing session with a blocked user account, and confirm access is denied.
5. Test any copied or embedded component separately if you use components in chat or other apps.
6. Review the Microsoft 365 sharing policy one more time if the result does not match what you expected.

You know the setup is working when the right users can view or edit the content without extra prompts, and blocked users cannot get in through old links, guest invites, or a copied component. If the wrong audience can still open it, the issue is usually in the tenant-level sharing settings, not in Loop itself.

Completion

You should see the intended users open the correct item, while the blocked account gets denied access. If that happens for the original page, workspace, and any copied or embedded component you tested, your Loop sharing is set up the way you want.

Common questions about Loop access and permissions

Guests can edit Loop content only if your Microsoft 365 sharing policy allows it and the specific page, workspace, or underlying storage location gives them edit rights. If guest access is blocked at the tenant level, inviting them from Loop will not override that.

If someone copies a Loop page, the copied version may not behave the same as the original. A copy can create a separate item with its own permissions, or it can carry forward content in a way that still depends on the original sharing model. Check the new item directly instead of assuming the old permissions disappeared.

A user may still see content after you remove access because links were already shared, the content was cached in a client, or they still have permission through another group or workspace membership. If access changes do not seem to take effect, review all paths to the item, not just the one link you changed.

Anonymous links are the riskiest option because anyone who gets the link may be able to open the content without signing in, depending on tenant policy. If you do not need that behavior, keep it disabled in Microsoft 365 and use named users instead.

Conclusion

The safest Loop setup is not one magic switch. It’s a mix of tenant sharing limits in Microsoft 365 and careful item-level sharing in Loop. If you set the Microsoft 365 boundaries first, share only the specific page or workspace people need, and then test access with another account, you can keep Loop useful without opening up more content than intended. When something looks wider than it should, check SharePoint and OneDrive settings before you assume Loop is the problem.

Frequently Asked Questions

Can guests edit Microsoft Loop content?

Sometimes, but only if your Microsoft 365 tenant allows guest access and the specific Loop content is shared with edit permission. If guest sharing is blocked at the tenant level, guests cannot edit even if someone tries to invite them from Loop.

What happens if I share a Loop page instead of a workspace?

A page share usually gives access only to that page, which is narrower than workspace access. A workspace share can expose multiple pages and anything else in that workspace, so use it only when that broader access is intended.

Why can someone still open a Loop page after I removed access?

They may still have another permission path, such as a workspace membership, an old link, or a copied version of the content. Check all sharing routes, not just the one permission you changed.

Do anonymous links work for Loop?

They can, if your Microsoft 365 sharing settings allow anyone links. If you want to avoid anonymous access, disable that option in the tenant settings and use named users or guests instead.