mxHERO Shares Link Types and Security – mxHero Help Center

When a rule stores attachments in mxHERO Shares, recipients get links to https://{tenant}.mxherocloud.com. This page explains the link types you can use, how recipients sign in, how expiration and retention work, and which combinations to avoid.

Before you begin

Set up mxHERO Shares in mxHERO Shares › Settings: tenant subdomain, region, retention and sign-in methods. See mxHERO Shares Settings.
Link security is set per rule, with a Security Definition or Security Policy. See Security Definitions and Policies.

Link types

Link type (Security Definition access)	Who can open it	How they get in
Public ("Accessible to anyone")	Anyone with the link	Opens directly
Public with password	Anyone with the link and the password	Enters the password mxHERO emailed separately
Organization ("Accessible to people in the organization")	Anyone with an email address in one of your organization's domains	Signs in with a method allowed for organization members
Authenticated ("Accessible to individual user with authentication")	Only the specific recipient the link was created for	Signs in with a method allowed for external recipients, using that exact email address

Recipients access links (collaborator links) are not available for mxHERO Shares.

Built-in definitions for mxHERO Shares

Name	Type	Expires
Public access links	Public	Per retention (see below)
7 days expiration public access links	Public	7 days
Password protected access links	Public with password	Per retention
Organization access links	Organization	Per retention
Authenticated access links	Authenticated	Per retention

A new rule that stores in mxHERO Shares starts with 7 days expiration public access links. You can create your own definitions with a different expiration.

You choose the allowed methods in mxHERO Shares › Settings, separately for:

For external users: used by Authenticated links
For members of your organization: used by Organization links

Method	What the recipient does
Send code by email	Enters their email address and receives a 6-digit code by email from `noreply@notifications.mxhero.com`. The code is valid for 10 minutes and can be used once.
Google Sign-In	Signs in with their Google account.
Microsoft Sign-In	Signs in with their Microsoft work or school account. mxHERO checks the account's email address (not the sign-in name).

The signed-in email address must match:

For Authenticated links: the recipient address the link was created for (letter case doesn't matter).
For Organization links: an address in any of your organization's domains.

Anyone else sees a message that they're not authorized.

Important: If your users sign in with Microsoft and some accounts have no email address set (sign-in name only), they can't open Organization or Authenticated links with Microsoft. Allow Send code by email as well.

Passwords

mxHERO generates a password for each link (or each recipient) and emails it in a separate message, following your password policy (Settings › Integrations › Storage settings › Storage Link Password Settings).
The password is stored only as a secure hash.
Use passwords only with Public links. On Organization and Authenticated links, the sign-in check runs first and the password is never requested, so it adds no protection.

For password-protected ZIP files stored in mxHERO Shares, see Zip Attachments.

Expiration and retention

Every link has an expiration, decided like this:

Security Definition sets an expiration?	Shares Retention policy One Year	Shares Retention policy No expiration
Yes (for example 7 days)	That expiration	That expiration
No	365 days after the link was created	Never expires

After a link expires, recipients see "The file does not exist or has expired".

Retention is set in mxHERO Shares › Settings and can be changed after setup. Content is tagged with the retention in force when it was uploaded.

Download and preview

Recipients can preview common file types in the browser and download them. See Recipient Experience.
To stop downloads organization-wide, use the browse restriction in mxHERO Shares › Settings. Per-link "prevent download" isn't offered for mxHERO Shares.
File owners can change their links in the End User App (expiration, password, download option, revoke, delete), within the permissions you grant in mxHERO Shares › Settings. See Managing Shared Files.

Revoke or delete

Action (End User App)	Effect
Revoke a share	The link stops working immediately. The file stays in Shares.
Delete a file	The file and all of its shares are removed. Every link to it stops working.

Choose a link type

Situation	Recommended
Sensitive files to specific external recipients	Authenticated links, with Code and the recipients' likely providers (Google, Microsoft) allowed
Internal distribution	Organization links
External recipients who can't sign in	Public links with a short expiration, optionally with a password
Large distribution lists with one shared link	Public or Organization links. Authenticated links aren't available when the rule sends the same copy of the links to all recipients.

Troubleshooting

Symptom	Cause	Fix
Recipient sees "not authorized" on an Authenticated link	They signed in with a different address than the one the email was sent to (for example, a personal account or an alias)	Ask them to sign in with the address the email was sent to, or use the Code method.
Recipient isn't asked for the password	The link is Organization or Authenticated; the password is ignored	Use Public links for password protection.
Authenticated option missing in the rule	The rule sends the same copy of links to all recipients, or the target is Forwarding Address or User Mailboxes	Use individual copies per recipient, or another link type.
Recipient says the code expired	The code is valid for 10 minutes	Ask them to request a new code and use it right away.
Link says "does not exist or has expired"	Expired, revoked, deleted, or the file was blocked as malware	Check the share in the End User App, and mxHERO Shares › Malware.