Team: 1 Designer, 1 Product Manager, 1 Engineer, 1 Researcher
‍Timeline: June 2018 – November 2018

OneDrive Business link sharing model enables users to generate multiple permission-specific links, allowing secure document sharing without the risk of leaks or unwanted edits—supporting the business goal of increasing collaboration.

However, a key limitation is that permissions are set at the link level, meaning any changes affect all people with that link rather than individuals. You can't change the permission of a sharing link from edit to view or from view to edit. The way around it is to delete your sharing link and create a new one with a different permission.

#1 People are struggling with changing individual’s permission
‍In the original interface, OneDrive didn’t explain how to adjust permissions for specific users. It was confusing and almost impossible to do. Users often couldn’t understand how it worked. They risk accidentally changing the entire link’s settings, which is not what they intend.

#2 Tracking and removing people’s access is difficult
A similar problem occurs when a user needs to remove someone’s access. They have to hunt through each shared link to find the person. If they miss one and think they’ve already removed access, they risk accidentally leaking a confidential file. Relying on small avatar pictures also makes it difficult to clearly see who has access and who doesn’t.

Rather than focusing on links, we shifted the focus to people. We pulled profile avatars to the forefront and grouped links beneath each person. Users often manage access with specific individuals in mind, so the new people-centric list helps them quickly find and manage the right person.

We introduced lightweight, upfront guidance. When users hover over the permission icon, a callout immediately appears, explaining how permission changes work and guiding them toward the correct action. This approach set clear expectations early, before users entered the permission-changing flow. So, users can felt more in control and confident when managing individual access.

We conducted a study with six participants—including IT admins and information workers—to measure task success and user satisfaction. While participants successfully completed all tasks, they were dissatisfied with the experience of changing individual permissions.