Consulting, engineering, architecture, and marketing firms run on documents. Proposals, client deliverables, financial models, designs, and contracts all live in Microsoft 365 for a growing number of firms. That's a good thing. Microsoft 365 makes collaboration easier than ever.

The catch is that the platform makes sharing easy too. Over time, firms end up with hundreds of links to client files floating around, some of them accessible to anyone who happens to get the URL.

You don't need to be an IT expert to understand the settings that matter. This guide explains the key sharing controls in plain language so firm leaders can ask the right questions.

Why Sharing Settings Drift Over Time

When most firms set up Microsoft 365, they leave the default settings in place. Then people start sharing. A project manager sends a link to a client. A designer shares a folder with a subcontractor. Someone creates a link that anyone can open because it was the fastest way to meet a deadline.

None of these choices is unusual. But added together, they mean the firm may not know who can see its client data. Unapproved tools make this worse, as we explain in our article on shadow IT.

Setting 1: External Sharing Level

SharePoint and OneDrive let administrators choose how widely files can be shared outside the firm. The options generally range from:

• Anyone: links that work for anyone who has them, with no sign-in.
• New and existing guests: outside people must verify their identity.
• Existing guests only: sharing is limited to people already approved.
• Only people in your organization: no external sharing at all.

Question to ask: "Do we really need 'Anyone' links, or can we require outside people to verify who they are?"

Many professional services firms choose to require verification for external sharing, which still allows client collaboration while blocking anonymous access.

Setting 2: Default Link Type

When someone clicks "Share," Microsoft 365 suggests a default type of link. If the default is a broad link, people will use it, simply because it's selected.

Question to ask: "What's our default sharing link, and can we change it to 'specific people'?"

Changing the default doesn't block anyone from working. It just makes the safer choice the easy choice.

Setting 3: Link Expiration

Links to client deliverables often stay active for years after a project ends. Administrators can set external links to expire automatically after a set number of days.

Question to ask: "Do our external links expire, and is the timeframe right for how long our projects usually last?"

Setting 4: Guest Accounts

When firms collaborate in Microsoft Teams or SharePoint with outside people, those people often become "guests" in your environment. Former subcontractors and past clients may still have access long after the work ends.

Question to ask: "How often do we review guest accounts, and who removes the ones we no longer need?"

A quarterly review is a reasonable starting point for most firms.

Setting 5: Sign-In Protections

Sharing settings protect files from outsiders. Sign-in protections protect your own accounts. Key controls include:

• Multifactor authentication for every user.
• Conditional access policies, available in some Microsoft 365 plans, which can block sign-ins from risky locations or unmanaged devices.
• Blocking older sign-in methods that don't support modern security checks.

Question to ask: "Does our Microsoft 365 plan include conditional access, and are we using it?"

Setting 6: Sensitivity Labels and Data Loss Prevention

Some Microsoft 365 plans include tools that label documents by sensitivity and warn users before sharing confidential information outside the firm. These tools take more planning but can be valuable for firms that handle financial data, personal information, or trade secrets.

Question to ask: "Do we handle client information sensitive enough to justify labels or data loss prevention?"

A One-Hour Review Plan

If you're not sure where your firm stands, a focused review can uncover most issues quickly:

1. Check the external sharing level for SharePoint and OneDrive.
2. Check the default link type.
3. Confirm whether external links expire.
4. Pull a list of guest users and flag any that are no longer needed.
5. Confirm multifactor authentication is on for every account.
6. Run a sharing report to find files shared with "Anyone" links.

Security That Doesn't Slow Down Client Work

The goal isn't to stop sharing. It's to make sure sharing happens deliberately. Firms that tighten these settings usually find that staff barely notice the change, while client data becomes far easier to control.

Maise Technology helps professional services firms configure Microsoft 365 through our cloud services and protect accounts with our cybersecurity services. If you'd like a second set of eyes on your settings, Schedule A 15 Minute Discovery Call.

Law firms share files all day. Draft agreements go to clients. Discovery goes to opposing counsel. Medical records come in from providers. Financial statements move between accountants, lenders, and the firm.

Every one of those exchanges carries confidential information. And the method a firm uses to share it matters more than many attorneys realize.

This article compares the most common file-sharing methods law firms use, explains where each one creates risk, and offers a practical way to choose the right tool for each situation.

The Professional Duty Behind the Technology

Lawyers have an ethical duty to protect client information. ABA Model Rule 1.6(c) asks lawyers to make reasonable efforts to prevent unauthorized access to or disclosure of client information. The ABA's Formal Opinion 477R discusses how that applies to electronic communications and suggests that the level of protection should match the sensitivity of the information.

In plain terms, a routine scheduling email and a sealed settlement agreement don't need the same treatment. Firms should think about what they're sending, who it's going to, and what could happen if it ended up in the wrong hands. Each state adopts its own version of these rules, so check your state bar's guidance.

Comparing Common File-Sharing Methods

Regular email attachments

Where it works: Low-sensitivity documents such as public filings or meeting agendas.

Where it falls short: Attachments live forever in multiple inboxes. They can be forwarded without your knowledge. If either party's mailbox is compromised, every attachment in it is exposed. You also can't take a file back once it's sent.

Encrypted email

Where it works: Sensitive documents sent to clients who are comfortable with email.

Where it falls short: Encryption protects the message in transit, but recipients may still download and forward files. Some clients find the extra login steps confusing, which can lead them to ask for "just a regular email."

Cloud sharing links (OneDrive, SharePoint, and similar tools)

Where it works: Larger files, collaborative drafting, and ongoing matters.

Where it falls short: Links are only as secure as their settings. A link set to "anyone with the link" can be opened by anyone who receives it, including someone it was forwarded to. Links also tend to stay active long after a matter closes.

Client portals

Where it works: Recurring exchanges with clients, especially in estate planning, family law, and business practices.

Where it falls short: A portal only helps if clients actually use it. Poor usability drives people back to email.

Personal file-sharing accounts

Where it works: It doesn't. Staff using personal cloud storage accounts to move client files creates serious risk, because the firm has no control over who has access or what happens when the employee leaves.

This last category is a form of "shadow IT," which we cover in how employees using unauthorized apps put your business at risk.

A Simple Decision Guide

Many firms find it helpful to sort documents into three tiers:

Writing this down and training staff on it removes guesswork. It also gives the firm a defensible answer if a client asks how their information was protected.

Cloud Sharing Settings Worth Reviewing

If your firm uses Microsoft 365 or a similar platform, a few settings make a large difference:

• Restrict "anyone with the link" sharing, or turn it off entirely.
• Default new links to specific people rather than everyone.
• Set expiration dates on external links.
• Require external users to verify their identity.
• Review externally shared files when a matter closes.

Our cloud services help firms configure these settings so they protect clients without frustrating attorneys.

Don't Forget the Other Side of the Exchange

Files coming into the firm deserve attention too. Phishing emails often disguise themselves as shared documents from clients or courts. Train staff to be cautious with unexpected sharing links, especially ones that ask them to sign in before viewing.

A Quick Example

An associate shares a folder of a client's tax returns with the client's accountant using an open link. Months later, the accountant forwards an email containing that link to a mortgage broker. The broker's assistant forwards it again. Nobody at the firm knows the documents are still accessible.

Had the link been restricted to the accountant's email address with a 30-day expiration, the chain would have stopped at the first forward.

Building Confidence With Clients

Clients increasingly ask how their information is protected. A clear file-sharing approach answers that question and strengthens trust. Maise Technology helps law firms put the right cybersecurity and data protection controls in place.

If you'd like help reviewing your firm's sharing practices, Schedule A 15 Minute Discovery Call.

This article is for general information and is not legal advice.

Donors give because they trust you. They trust you to use their gift well, and they trust you to protect the name, address, email, and payment details they handed over.

Most nonprofits take that trust seriously. The challenge is doing it on a budget that has to cover programs, staff, rent, and a dozen other priorities. The encouraging part is that the most effective protections for donor data are often low-cost. They depend more on smart choices than on expensive tools.

What Counts as Donor Data?

It's more than a list of names. Donor data usually includes:

• Contact details and mailing addresses.
• Giving history and gift amounts.
• Payment card or bank information for recurring gifts.
• Notes about relationships, interests, and family connections.
• Event registrations and volunteer records.

Some of this is sensitive because of identity theft risk. Some is sensitive because donors simply expect privacy. A major donor's giving history, for example, isn't something they'd want shared beyond your development team.

Where Nonprofits Most Often Leave Gaps

When we review nonprofit systems, the same issues come up again and again. None of them come from carelessness. They come from growing quickly with limited staff.

Exports that never get cleaned up

Someone pulls a donor list into a spreadsheet for a mailing or a gala. The file gets emailed to a volunteer, saved to a laptop, and forgotten. Months later, there are copies everywhere.

Too many people with full access

Donor databases often give every user administrator rights because it was easier during setup. A volunteer who only enters event registrations doesn't need to see every gift amount or export the entire database.

Passwords without a second check

If the donor database login is just a password, one successful phishing email can expose everything. Multifactor authentication adds a second step, such as a code on a phone, that stops most of these attacks.

Payment details stored where they shouldn't be

Card numbers written on paper pledge forms, saved in spreadsheets, or typed into email create real risk. Payment data should go through a reputable payment processor, not live in your own files.

A Prioritized Checklist for Limited Budgets

Rather than trying to do everything, start at the top of this list and work down. The first items deliver the most protection for the least cost.

Do this month

• Turn on multifactor authentication for your donor database, email, and payment platform.
• Review who has access to the donor database, and remove anyone who no longer needs it.
• Confirm card payments are processed through a payment provider, not stored by your organization.

Do this quarter

• Set user roles so people only see the data their job requires.
• Find and delete old donor exports on shared drives, laptops, and email.
• Create a simple rule for how donor lists are shared with volunteers and vendors.

Do this year

• Confirm your donor database is backed up and test restoring it.
• Provide short security awareness training for staff and key volunteers.
• Review the security practices of vendors who handle donor data, such as mailing houses or event platforms.

Not sure where your biggest gaps are? A cybersecurity risk assessment can help you rank priorities based on your actual systems.

Free and Low-Cost Resources Worth Knowing

Many technology vendors offer nonprofit discounts or donated licenses, including business-grade email and productivity tools with built-in security features. Before buying a new security product, check whether a tool you already pay for has a protection you haven't turned on yet. That happens more often than you'd think.

Talking to Your Board About Donor Data

Boards don't need technical detail. They need to understand risk and responsibility. A helpful way to frame it is:

• What donor information do we hold?
• Who can access it?
• What would happen to donor trust if it were exposed?
• What are we doing this year to reduce that risk?

Framing security as donor stewardship, rather than an IT expense, often helps leaders see why it matters.

A Realistic Example

A regional food bank's development coordinator received an email that appeared to come from its donor database provider, asking her to "re-verify" her login. She entered her password. Because the organization had turned on multifactor authentication three months earlier, the attacker couldn't get in without the code sent to her phone. The coordinator reported the email, reset her password, and the issue was closed in under an hour.

That outcome cost almost nothing to achieve. It simply required turning on a feature that was already available.

Protect the Trust You've Earned

Donor data security doesn't require a large budget. It requires clear priorities and steady follow-through. Maise Technology supports mission-driven organizations with practical cybersecurity services sized for real nonprofit budgets. Learn more on our IT services for nonprofit organizations page.

If you'd like help putting this checklist into action, Schedule A 15 Minute Discovery Call and we'll talk through your donor systems and where to start.