Consulting, engineering, architecture, and marketing firms run on documents. Proposals, client deliverables, financial models, designs, and contracts all live in Microsoft 365 for a growing number of firms. That's a good thing. Microsoft 365 makes collaboration easier than ever.

The catch is that the platform makes sharing easy too. Over time, firms end up with hundreds of links to client files floating around, some of them accessible to anyone who happens to get the URL.

You don't need to be an IT expert to understand the settings that matter. This guide explains the key sharing controls in plain language so firm leaders can ask the right questions.

Why Sharing Settings Drift Over Time

When most firms set up Microsoft 365, they leave the default settings in place. Then people start sharing. A project manager sends a link to a client. A designer shares a folder with a subcontractor. Someone creates a link that anyone can open because it was the fastest way to meet a deadline.

None of these choices is unusual. But added together, they mean the firm may not know who can see its client data. Unapproved tools make this worse, as we explain in our article on shadow IT.

Setting 1: External Sharing Level

SharePoint and OneDrive let administrators choose how widely files can be shared outside the firm. The options generally range from:

  • Anyone: links that work for anyone who has them, with no sign-in.
  • New and existing guests: outside people must verify their identity.
  • Existing guests only: sharing is limited to people already approved.
  • Only people in your organization: no external sharing at all.

Question to ask: "Do we really need 'Anyone' links, or can we require outside people to verify who they are?"

Many professional services firms choose to require verification for external sharing, which still allows client collaboration while blocking anonymous access.

Setting 2: Default Link Type

When someone clicks "Share," Microsoft 365 suggests a default type of link. If the default is a broad link, people will use it, simply because it's selected.

Question to ask: "What's our default sharing link, and can we change it to 'specific people'?"

Changing the default doesn't block anyone from working. It just makes the safer choice the easy choice.

Setting 3: Link Expiration

Links to client deliverables often stay active for years after a project ends. Administrators can set external links to expire automatically after a set number of days.

Question to ask: "Do our external links expire, and is the timeframe right for how long our projects usually last?"

Setting 4: Guest Accounts

When firms collaborate in Microsoft Teams or SharePoint with outside people, those people often become "guests" in your environment. Former subcontractors and past clients may still have access long after the work ends.

Question to ask: "How often do we review guest accounts, and who removes the ones we no longer need?"

A quarterly review is a reasonable starting point for most firms.

Setting 5: Sign-In Protections

Sharing settings protect files from outsiders. Sign-in protections protect your own accounts. Key controls include:

  • Multifactor authentication for every user.
  • Conditional access policies, available in some Microsoft 365 plans, which can block sign-ins from risky locations or unmanaged devices.
  • Blocking older sign-in methods that don't support modern security checks.

Question to ask: "Does our Microsoft 365 plan include conditional access, and are we using it?"

Setting 6: Sensitivity Labels and Data Loss Prevention

Some Microsoft 365 plans include tools that label documents by sensitivity and warn users before sharing confidential information outside the firm. These tools take more planning but can be valuable for firms that handle financial data, personal information, or trade secrets.

Question to ask: "Do we handle client information sensitive enough to justify labels or data loss prevention?"

A One-Hour Review Plan

If you're not sure where your firm stands, a focused review can uncover most issues quickly:

  1. Check the external sharing level for SharePoint and OneDrive.
  2. Check the default link type.
  3. Confirm whether external links expire.
  4. Pull a list of guest users and flag any that are no longer needed.
  5. Confirm multifactor authentication is on for every account.
  6. Run a sharing report to find files shared with "Anyone" links.

Security That Doesn't Slow Down Client Work

The goal isn't to stop sharing. It's to make sure sharing happens deliberately. Firms that tighten these settings usually find that staff barely notice the change, while client data becomes far easier to control.

Maise Technology helps professional services firms configure Microsoft 365 through our cloud services and protect accounts with our cybersecurity services. If you'd like a second set of eyes on your settings, Schedule A 15 Minute Discovery Call.