Consulting, engineering, architecture, and marketing firms run on documents. Proposals, client deliverables, financial models, designs, and contracts all live in Microsoft 365 for a growing number of firms. That's a good thing. Microsoft 365 makes collaboration easier than ever.

The catch is that the platform makes sharing easy too. Over time, firms end up with hundreds of links to client files floating around, some of them accessible to anyone who happens to get the URL.

You don't need to be an IT expert to understand the settings that matter. This guide explains the key sharing controls in plain language so firm leaders can ask the right questions.

Why Sharing Settings Drift Over Time

When most firms set up Microsoft 365, they leave the default settings in place. Then people start sharing. A project manager sends a link to a client. A designer shares a folder with a subcontractor. Someone creates a link that anyone can open because it was the fastest way to meet a deadline.

None of these choices is unusual. But added together, they mean the firm may not know who can see its client data. Unapproved tools make this worse, as we explain in our article on shadow IT.

Setting 1: External Sharing Level

SharePoint and OneDrive let administrators choose how widely files can be shared outside the firm. The options generally range from:

• Anyone: links that work for anyone who has them, with no sign-in.
• New and existing guests: outside people must verify their identity.
• Existing guests only: sharing is limited to people already approved.
• Only people in your organization: no external sharing at all.

Question to ask: "Do we really need 'Anyone' links, or can we require outside people to verify who they are?"

Many professional services firms choose to require verification for external sharing, which still allows client collaboration while blocking anonymous access.

Setting 2: Default Link Type

When someone clicks "Share," Microsoft 365 suggests a default type of link. If the default is a broad link, people will use it, simply because it's selected.

Question to ask: "What's our default sharing link, and can we change it to 'specific people'?"

Changing the default doesn't block anyone from working. It just makes the safer choice the easy choice.

Setting 3: Link Expiration

Links to client deliverables often stay active for years after a project ends. Administrators can set external links to expire automatically after a set number of days.

Question to ask: "Do our external links expire, and is the timeframe right for how long our projects usually last?"

Setting 4: Guest Accounts

When firms collaborate in Microsoft Teams or SharePoint with outside people, those people often become "guests" in your environment. Former subcontractors and past clients may still have access long after the work ends.

Question to ask: "How often do we review guest accounts, and who removes the ones we no longer need?"

A quarterly review is a reasonable starting point for most firms.

Setting 5: Sign-In Protections

Sharing settings protect files from outsiders. Sign-in protections protect your own accounts. Key controls include:

• Multifactor authentication for every user.
• Conditional access policies, available in some Microsoft 365 plans, which can block sign-ins from risky locations or unmanaged devices.
• Blocking older sign-in methods that don't support modern security checks.

Question to ask: "Does our Microsoft 365 plan include conditional access, and are we using it?"

Setting 6: Sensitivity Labels and Data Loss Prevention

Some Microsoft 365 plans include tools that label documents by sensitivity and warn users before sharing confidential information outside the firm. These tools take more planning but can be valuable for firms that handle financial data, personal information, or trade secrets.

Question to ask: "Do we handle client information sensitive enough to justify labels or data loss prevention?"

A One-Hour Review Plan

If you're not sure where your firm stands, a focused review can uncover most issues quickly:

1. Check the external sharing level for SharePoint and OneDrive.
2. Check the default link type.
3. Confirm whether external links expire.
4. Pull a list of guest users and flag any that are no longer needed.
5. Confirm multifactor authentication is on for every account.
6. Run a sharing report to find files shared with "Anyone" links.

Security That Doesn't Slow Down Client Work

The goal isn't to stop sharing. It's to make sure sharing happens deliberately. Firms that tighten these settings usually find that staff barely notice the change, while client data becomes far easier to control.

Maise Technology helps professional services firms configure Microsoft 365 through our cloud services and protect accounts with our cybersecurity services. If you'd like a second set of eyes on your settings, Schedule A 15 Minute Discovery Call.

Law firms share files all day. Draft agreements go to clients. Discovery goes to opposing counsel. Medical records come in from providers. Financial statements move between accountants, lenders, and the firm.

Every one of those exchanges carries confidential information. And the method a firm uses to share it matters more than many attorneys realize.

This article compares the most common file-sharing methods law firms use, explains where each one creates risk, and offers a practical way to choose the right tool for each situation.

The Professional Duty Behind the Technology

Lawyers have an ethical duty to protect client information. ABA Model Rule 1.6(c) asks lawyers to make reasonable efforts to prevent unauthorized access to or disclosure of client information. The ABA's Formal Opinion 477R discusses how that applies to electronic communications and suggests that the level of protection should match the sensitivity of the information.

In plain terms, a routine scheduling email and a sealed settlement agreement don't need the same treatment. Firms should think about what they're sending, who it's going to, and what could happen if it ended up in the wrong hands. Each state adopts its own version of these rules, so check your state bar's guidance.

Comparing Common File-Sharing Methods

Regular email attachments

Where it works: Low-sensitivity documents such as public filings or meeting agendas.

Where it falls short: Attachments live forever in multiple inboxes. They can be forwarded without your knowledge. If either party's mailbox is compromised, every attachment in it is exposed. You also can't take a file back once it's sent.

Encrypted email

Where it works: Sensitive documents sent to clients who are comfortable with email.

Where it falls short: Encryption protects the message in transit, but recipients may still download and forward files. Some clients find the extra login steps confusing, which can lead them to ask for "just a regular email."

Cloud sharing links (OneDrive, SharePoint, and similar tools)

Where it works: Larger files, collaborative drafting, and ongoing matters.

Where it falls short: Links are only as secure as their settings. A link set to "anyone with the link" can be opened by anyone who receives it, including someone it was forwarded to. Links also tend to stay active long after a matter closes.

Client portals

Where it works: Recurring exchanges with clients, especially in estate planning, family law, and business practices.

Where it falls short: A portal only helps if clients actually use it. Poor usability drives people back to email.

Personal file-sharing accounts

Where it works: It doesn't. Staff using personal cloud storage accounts to move client files creates serious risk, because the firm has no control over who has access or what happens when the employee leaves.

This last category is a form of "shadow IT," which we cover in how employees using unauthorized apps put your business at risk.

A Simple Decision Guide

Many firms find it helpful to sort documents into three tiers:

Writing this down and training staff on it removes guesswork. It also gives the firm a defensible answer if a client asks how their information was protected.

Cloud Sharing Settings Worth Reviewing

If your firm uses Microsoft 365 or a similar platform, a few settings make a large difference:

• Restrict "anyone with the link" sharing, or turn it off entirely.
• Default new links to specific people rather than everyone.
• Set expiration dates on external links.
• Require external users to verify their identity.
• Review externally shared files when a matter closes.

Our cloud services help firms configure these settings so they protect clients without frustrating attorneys.

Don't Forget the Other Side of the Exchange

Files coming into the firm deserve attention too. Phishing emails often disguise themselves as shared documents from clients or courts. Train staff to be cautious with unexpected sharing links, especially ones that ask them to sign in before viewing.

A Quick Example

An associate shares a folder of a client's tax returns with the client's accountant using an open link. Months later, the accountant forwards an email containing that link to a mortgage broker. The broker's assistant forwards it again. Nobody at the firm knows the documents are still accessible.

Had the link been restricted to the accountant's email address with a 30-day expiration, the chain would have stopped at the first forward.

Building Confidence With Clients

Clients increasingly ask how their information is protected. A clear file-sharing approach answers that question and strengthens trust. Maise Technology helps law firms put the right cybersecurity and data protection controls in place.

If you'd like help reviewing your firm's sharing practices, Schedule A 15 Minute Discovery Call.

This article is for general information and is not legal advice.

It's 7:10 on a Monday in July. The phones are already ringing because half the valley's air conditioners gave up over the weekend. Your dispatcher opens the scheduling software to assign the first calls of the day.

The screen spins. Then it shows an error.

Eight technicians are sitting in their vans waiting for addresses. Customers are calling. Nobody can see who's booked, what parts are on which truck, or which jobs are emergencies.

For home service companies, dispatch software is the nervous system of the business. When it goes down, everything slows to a crawl. This article walks through why outages happen and how to plan for them before they cost you a day of revenue.

Why Dispatch Systems Go Down

Most field service platforms today are cloud-based. That makes them reliable most of the time, but not immune to problems. Outages typically come from:

• The software provider's own outage, which you can't control.
• Your office internet going down, cutting off access even when the software is fine.
• Account or login problems, such as an expired password or a locked admin account.
• Integration failures between dispatch, payments, and accounting tools.
• Cyberattacks, including compromised accounts or ransomware on office computers.

Some of these last ten minutes. Others last all day. Your plan should cover both.

What an Outage Really Costs

The obvious cost is missed jobs. But the hidden costs often hurt more:

• Technicians on the clock with nowhere to go.
• Emergency calls that go to a competitor because nobody answered.
• Double-booked appointments when the system comes back.
• Lost notes about equipment, warranties, or gate codes.
• Frustrated customers who expected a confirmation text.

We explore these effects in more detail in the real cost of IT downtime for small and mid-sized businesses.

Build a Simple Outage Plan

An outage plan doesn't need to be a thick binder. For most home service companies, one or two pages covers it. Here's what to include.

1. A daily schedule snapshot

At the end of each day, export or print the next day's schedule with customer names, addresses, phone numbers, and job types. Store it somewhere you can reach without the software, such as a shared drive that syncs to a phone or a printed copy in the office. If the system goes down at 7 a.m., you still know who's expecting a technician.

2. A backup communication method

Decide in advance how dispatch will reach technicians if the app isn't working. A group text thread or a phone call tree works. Make sure everyone knows which one to use.

3. Paper work orders

Keep a stack of blank work orders in every van. Technicians can record parts, labor, and customer signatures on paper, then enter them later.

4. A second internet connection

If your office internet fails, a backup connection, such as a cellular hotspot or a second provider, can keep dispatch online. This is often one of the cheapest fixes on the list.

5. Clear decision points

Write down who decides when to switch to the backup plan. A simple rule works: "If the system is down for more than 15 minutes during business hours, go to manual dispatch."

6. A cleanup process

When the software comes back, someone needs to enter paper records and confirm appointments. Assign that job ahead of time so it doesn't fall through the cracks.

Reduce the Chance of an Outage Starting With You

You can't prevent your software provider from having a bad day. You can reduce the risk of problems that start inside your business:

• Use multifactor authentication on your dispatch and payment accounts.
• Make sure more than one person has administrator access.
• Keep office computers updated and protected against malware.
• Know your provider's status page and support contact before you need them.

Many of these platforms run in the cloud, which changes how you think about backups. Our cloud services page covers how businesses can protect data that lives outside the office.

Practice It Once

A plan that's never been tested usually breaks in small ways. On a slow afternoon, try running dispatch from the backup schedule for 30 minutes. You'll quickly learn whether phone numbers are missing, whether technicians know where to look, and whether the printed schedule is actually current.

Outages Are Inevitable. Chaos Isn't.

Every home service company will face a dispatch outage at some point. The difference between a minor delay and a lost day is preparation. Thinking about this now, on a calm day, is the best investment you can make.

Maise Technology helps service businesses plan for disruptions through practical business continuity services. Have questions about where to start? Get In Touch.