Can a shared link be forwarded to somebody else?¶

Yes. The text of a shared link can be copied into another message, document or service. Whether the next recipient can use it depends on the link's access controls, not on who received it first.

Transfer and successful access are separate events¶

An “anyone with the link” route normally travels with the URL: a later recipient can use the same capability until it expires or is revoked. A named-account or organisation-only link can still be forwarded, but an unauthorised recipient should be stopped at sign-in or permission checking.

Password-protected links add another requirement, although the password may itself be passed on. Provider configuration at the event time is therefore essential.

Keep four roles distinct¶

One link can involve:

1. the account that created it;
2. the original intended recipient;
3. a person or system that forwarded or exposed it; and
4. the account, application or connection that later used it.

Those roles may coincide, but the link alone does not make them the same. Browser synchronisation, group chats, collaborative documents and automated previews can also copy or request URLs without a deliberate onward disclosure to one named person.

Dave creates OneDrive link SH-8F21 and sends it to Priya in Teams message MSG-104. Priya forwards the message to group chat CHAT-7; later, account C-66308 successfully views object OBJ-4407. The creator, first recipient, forwarder and recorded user can now be stated separately, while the forwarding route is supported by message records rather than guessed from the later access.

Reconstruct the route where it matters¶

Provider records can establish creation, settings, changes, revocation and access. Messages, audit records or device artefacts may show the link being forwarded. A later access from a different account or connection can support onward use, particularly when timing and object activity align.

The next useful records are the share settings at each time, message IDs or device artefacts showing transfer, and the session behind the later access.

Use shared-link attribution for the final human link. Do not describe the original recipient as the later user merely because no forwarding message has yet been found.