Legitimate SharePoint requests come from your IT department or a named coworker, never from a generic email address or a link you found yourself

A real SharePoint document request includes the sender's full name, their role in your organization, and a reason tied to actual work you do together. The request arrives in your work email inbox — not your personal email, not a text message, not a chat from someone you've never met. The person asking can be verified by looking them up in your company directory or asking your manager if you're unsure.

Fake requests often come from addresses that look almost like your company's domain but aren't quite right — sharepoint-verify@yourcompany.co instead of sharepoint@yourcompany.com, for example. They may ask you to "confirm your identity" or "update your credentials" before accessing a document. Real SharePoint access doesn't work that way. Your organization already has your credentials on file.

Key Takeaways

  • Legitimate requests come from people you can identify through your company directory, not from generic support addresses or external email accounts.
  • Real requests name the specific document or folder and explain why that person needs it, not vague language about "verifying access" or "updating permissions."
  • Your IT department will never ask you to enter your password, reset your credentials, or click a link to "confirm your identity" in order to share a document.
  • If you're uncertain whether a request is real, ask your manager or IT department directly using contact information you find yourself, not information provided in the suspicious message.

What a legitimate request looks like in practice

A real SharePoint request usually arrives as an email from someone whose name you recognize or can verify. It says something like: "Hi James, I need access to the Q4 budget spreadsheet in the Finance folder so I can review the department projections for my report. Can you share that with me?" The sender is asking for one specific thing, and the reason is concrete.

The request might also come through your organization's internal chat system — Slack, Teams, or whatever your company uses — from someone with a verified account and a profile picture. In that case, you can click their name to see their job title and department, which confirms they work there.

Sometimes your IT department sends a message saying they're moving files to a new SharePoint location or updating permissions, and they need you to take an action. These messages come from your official IT support email address, which you can find on your company's internal website or by asking your manager. They never ask you to enter your password or click a suspicious link.

Red flags that signal a fake request

Stop and verify if a request asks you to click a link to "confirm your identity," "update your password," "verify your account," or "set up your access." SharePoint doesn't work that way. Your organization manages your access through its own systems, not through links in emails.

Be suspicious of requests from email addresses that are almost — but not quite — your company's real domain. Scammers register domains like yourcompany-find.com or sharepoint-yourcompany.net that look legitimate at a glance. Check the full email address carefully, not just the display name.

Generic language is another warning sign. Real coworkers say "I need the Johnson contract" or "Can you share the marketing calendar?" Fake requests say "Please verify your SharePoint access" or "Update your document permissions when ready." They create urgency or vagueness instead of naming what they actually want.

If someone asks you to share a document but their email address is a personal Gmail, Yahoo, or Outlook account — not your company domain — that's a red flag. Coworkers use company email to request work documents.

How to verify a request you're not sure about

The safest step is to contact the person directly using information you find yourself, not information in the message. If an email claims to be from "Sarah in Accounting," open your company directory or internal phone list and find Sarah's real phone number or email. Call or message her directly and ask if she sent the request. Don't use contact information from the suspicious message itself.

You can also ask your manager or your IT department. A quick message to your manager saying "I got a request to share a document with someone in the Finance team — is this normal?" takes 30 seconds and gives you confidence. Your IT department can also tell you whether a message claiming to be from them is real.

If the request came through your company's internal chat system, click the person's profile to see their full details and department. If they're a real employee, their profile will show their job title and how long they've worked there. If the profile is blank or looks fake, that's a sign to ask your manager before sharing anything.

What to do if you've already clicked a suspicious link

If you clicked a link in a message you now think was fake, tell your IT department right away. Don't wait to see if something happens. The sooner they know, the sooner they can check whether your account was compromised and take steps to protect it.

If you entered your password on a page that looked like SharePoint or your company login, change your password when ready using your company's official password reset tool — not a link from the suspicious message. Then tell IT what happened. They may need to reset your account or monitor it for suspicious activity.

You won't get in trouble for reporting a fake request, even if you clicked the link. Organizations expect this to happen sometimes, and IT departments are set up to help. The faster you report it, the faster they can help.

SharePoint permissions and how your organization actually manages them

Your organization controls who can see and edit documents through SharePoint's built-in permission system. When someone needs access, the document owner or a SharePoint administrator changes the permissions — they don't ask you to click a link or enter credentials.

If you're the document owner and someone asks for access, you can grant it directly through SharePoint. You open the document, click "Share," type the person's name or email, and choose what level of access they get (view only, edit, or owner). That's the real process. No passwords, no verification links, no confirmation emails asking you to click anything.

Your IT department manages site-wide permissions and can grant access to entire folders or libraries. But again, they do this through SharePoint's admin tools, not by asking you to click links in emails.

Frequently Asked Questions

What if someone asks me to share a document with an external person I don't know?

Ask your manager before sharing anything with someone outside your organization. Some companies have policies about what documents can be shared externally and with whom. Even if the request seems to come from a coworker, it's worth checking if you're not sure about the external person's role or why they need the file.

Can my company's IT department really never ask for my password?

Correct. Legitimate IT departments never ask for your password in emails, messages, or phone calls. If someone claiming to be from IT asks for your password, it's a scam. Your IT department already has the ability to reset your password or manage your account without you giving it to them.

What if I'm not sure whether someone actually works at my company?

Look them up in your company directory or internal phone list. If they're not there, ask your manager. You can also ask the person directly what team they're on and what their extension is, then verify that information independently. There's no harm in double-checking before sharing a document.

Does SharePoint ever send me emails asking me to take action on my account?

SharePoint may send you notifications about documents that have been shared with you or changes to documents you own, but these are informational. They don't ask you to click links to "verify" or "confirm" anything. If an email claims to be from SharePoint and asks you to click a link to update your account, it's fake.

What should I do if my coworker's email account gets hacked and someone sends a fake request using their name?

Tell your IT department when ready. They can check whether the account was compromised and help find it. In the meantime, don't click any links or read any files from that account until IT confirms it's safe. You can also message your coworker through a different channel — a phone call or a different chat app — to let them know their email might be compromised.