Microsoft 365 for Law Firms: What to Check Before Sharing Client Files
Before sharing a client file in Microsoft 365, verify intended recipients, guest access, link scope, expiration, permissions, downloaded copies, and matter confidentiality.
A client needs a draft before a deadline. Someone creates a SharePoint or OneDrive link, sends it, and moves on. The useful question is whether that link gives the right people the right access for the right amount of time.
Microsoft 365 sharing behavior depends on the tenant, site, file, link type, account, and current settings. Check the actual item and the organization's current configuration; do not assume every link works the same way.
Before you create or send a link
1. Confirm the intended recipients
List the people who need the file and why. Check spelling and addresses against a trusted source, especially when a client, co-counsel, expert, or vendor is new to the matter.
Ask the responsible attorney to confirm that each recipient may see the specific matter material. A general project group or firm-wide group is not proof that a person is cleared for every matter.
2. Choose the narrowest practical link scope
Use the link option that limits access to the intended people, subject to the firm's approved sharing process and the tenant's available controls. Avoid broadly usable links when an individually named recipient or authenticated guest can meet the need.
Check whether recipients must sign in, whether the link can be forwarded, and what permissions it grants. A link that allows editing is different from one that permits viewing.
Microsoft's SharePoint and OneDrive sharing settings guidance explains organization and site-level external-sharing controls. Available link options depend on the current settings and the item being shared.
3. Review guests and existing permissions
Check who already has access to the site, folder, or file, including guests and inherited groups. Remove access that is no longer needed through the authorized process, and record what was reviewed.
Do not rely on an ordinary group membership as proof of an ethical wall. Matter screens need a separately designed and authorized permission review across relevant sites, copies, and connected workspaces.
4. Set an expiration when appropriate
Where the tenant and link type support it, set an expiration consistent with the matter workflow. Confirm who owns the link and who will review or revoke it when the work ends.
Expiration or deletion can stop future access through a link. It does not recall a copy someone already downloaded, remove email attachments, or erase copies stored elsewhere.
5. Consider downloads and local copies
Ask whether recipients need to download or edit the file. If the matter requires tighter handling, ask the Microsoft 365 administrator which supported controls are available for the specific license and workflow.
Once a recipient has a local copy, link changes do not manage that copy. The firm may need a separate agreement, process, or follow-up to address local retention and deletion.
Keep a short sharing record
For sensitive or unusual transfers, record the matter, file or location, recipient, link type, permission, expiration, approving person, and review date in the firm's approved system. Do not place client documents, passwords, or unnecessarily detailed confidential facts in a general tracking sheet.
If an outside recipient changes or the matter closes, ask the owner to review access and confirm any needed revocation. For a broader check of Microsoft 365 identity, sharing, forwarding, logging, and recovery, use the Microsoft 365 security checklist for law firms. The law firm cybersecurity checklist helps assign owners across systems.
Review the controls with the right people
Microsoft's settings can limit sharing, but they do not decide whether disclosure is appropriate for a particular matter. The responsible attorney determines matter confidentiality and recipients; the administrator verifies what the configured service permits.
An authorized Law Firm Security Baseline can assess agreed Microsoft 365 settings and evidence alongside your existing IT provider. It does not include a full permissions redesign or remediation unless separately scoped.