Secure File Sharing for Professional Services Firms: Attachments, Links or a Client Portal

For most professional services firms, secure file sharing means sending sensitive client files through a SharePoint link restricted to named people, or through encrypted email, and keeping plain attachments for documents that wouldn’t matter if they went astray. A client portal earns its cost when the same exchange repeats with dozens of clients every season.

None of the four options is wrong. Each one fails somewhere different. Knowing where is most of the job.

A tax return. Stamped drawings. A renewal packet with a loss history in it. Those files leave offices every day as attachments, mostly because that’s how it has always been done. In over 20 years of running IT for small offices, I’ve found file sending is a habit that rarely changes until somebody asks about it. It’s also the part of IT for professional services firms that a firm’s own clients actually see.

What an Attachment Actually Does

Secure file sharing is any way of sending a client document that keeps it encrypted on the way, limits who can open it, and leaves a record of who did. A plain email attachment manages the first part only some of the time. The other two, never.

Why only some of the time? Exchange Online always tries to encrypt the connection to the receiving mail server with TLS, but if that server doesn’t support it, the message goes out unencrypted unless an admin has configured otherwise. And TLS protects the connection, not the message. Once it lands, the attachment sits in Sent Items, in the client’s inbox, and in whatever inbox it gets forwarded to. No recall. No record of who opened it.

Size is the other limit. Microsoft 365 mailboxes default to a 35 MB maximum for sending and 36 MB for receiving, adjustable by an admin anywhere from 1 MB to 150 MB, and the recipient’s mail system has its own ceiling on top. Architecture and engineering offices tend to run into that one first. Drawing sets are big.

Is an attachment ever fine? Of course. A meeting agenda. A brochure. The question is which files deserve better.

Four Ways a File Leaves the Office

Here’s how the options compare on the things a firm owner actually weighs.

Encrypted Email, and Who Asked for It First

Insurance agencies, as it turns out. The brokerages we work with “were also the first ones who needed encrypted email.” Not who you’d guess. Renewals run on applications and loss runs, and that paperwork travels by email whether anyone planned it or not.

In Microsoft 365 the tool is Microsoft Purview Message Encryption. Business Premium and the E3 and E5 plans include it, while Business Basic and Standard need an Azure Information Protection Plan 1 add-on. Senders pick encrypt-only or Do Not Forward. With Do Not Forward, Word, Excel and PowerPoint attachments stay protected after download, so a copy passed to someone new won’t open. An admin can also add a mail flow rule that encrypts automatically, say every external message with a certain word in the subject. Nobody has to remember.

What does the client see? If they read mail in Outlook on Microsoft 365, nothing unusual. Gmail and Yahoo users get a wrapper message that opens Microsoft’s encrypted message portal, where they sign in with that account or request a one-time passcode. They can reply encrypted, too. That matters when the client is the one sending documents.

Two limits. Encrypted messages top out at 25 MB including attachments, and SharePoint or OneDrive links inside them aren’t covered. Expiring a message or revoking a client’s access belongs to Advanced Message Encryption, which sits in the E5 tier, not Business Premium.

Then there’s the stronger version. It’s what I tell clients whenever protected health information is in the picture.

“We tell everybody, when the transmission of PHI comes up, you have to use encrypted email, and we build encrypted transports between our customers and the IT departments of their vendors and companies that they deal with.”

On Exchange Online, the mechanism Microsoft documents for a transport like that is forced TLS, a pair of connectors that won’t send to, or accept from, a named partner unless the connection is encrypted. Microsoft calls opportunistic TLS sufficient for most businesses and describes forcing it for organizations with compliance requirements, naming medical, banking and government. In professional services, think of a benefits consultancy or an agency handling health coverage details.

Encryption doesn’t prove who sent the message, by the way. That’s the job of DMARC, SPF and DKIM records on your domain. Different problem.

Share Links, and Why I’d Rather They Came From SharePoint

“Most companies utilize some form of OneDrive when they should be using SharePoint a lot more… OneDrive is a more user-based version of SharePoint, SharePoint is the company-based version of OneDrive. I think they should utilize SharePoint more.”

I say that a lot. The sharing settings are where it stops being a preference.

A link shared out of someone’s OneDrive belongs to that person’s account. When the account is deleted, the manager gets access for 30 days by default, then the OneDrive moves to the recycle bin and anything shared from it stops being reachable. An associate shares a drawing set from her OneDrive and later leaves? The client’s link dies a few weeks after her account does. A SharePoint site belongs to the firm. People leave. The client’s folder stays.

Where files should live at all is a separate decision, covered in my piece on keeping a file server or moving to SharePoint. Assuming they’re in Microsoft 365 already, here’s what I’d check in the SharePoint admin center.

• External sharing. Microsoft ships it turned on at the organization level. The levels run from Anyone, through New and existing guests and Existing guests, down to Only people in your organization, and a site can be stricter than the firm-wide setting but never looser.
• If the share box opens on Anyone, some people will click Send. Set the default link type to Specific people or Only people in your organization.
• Specific people links. Only the people named can open the file, and a forwarded invitation doesn’t work for anyone else. Outside recipients sign in with a work or Microsoft account, or enter a code sent to their email.
• Anyone links, if you keep them, can be forced to expire within a set number of days and limited to view only. Microsoft is plain about the trade. You can’t track who has access to items shared that way, or who opened them.
• Can’t download. A view-only link can block downloading, which suits a draft report meant to be read, not kept. A whole-site download block is a PowerShell policy that needs SharePoint Advanced Management. Neither stops a phone camera.
• Guest access can expire automatically after a set number of days, so last year’s contractors don’t linger.
• Separate sites for outside work. Microsoft’s advice is to keep confidential information in sites with external sharing off and create other sites for sharing. Simple. Rarely done.

Then there’s the record. Sharing events, from a guest accepting an invitation to someone creating an Anyone link, land in the Microsoft Purview audit log, included in Business Basic, Standard and Premium. Audit (Standard) keeps them for 180 days.

When a Client Portal Is Worth Paying For

Repetition decides it. Picture a CPA firm collecting documents for hundreds of individual returns between February and April, or an insurance agency sending renewal packets to every commercial account on a fixed cycle. Same exchange. Many clients. That’s where a portal pays for itself, mostly in time not spent re-sending links.

Even the IRS sample written information security plan for tax and accounting practices, Publication 5708, lists a password-protected portal as a way a firm may exchange documents containing personal information. It doesn’t name one. Neither will I. Here’s what I’d look for in any of them.

• Multi-factor sign-in for clients, not just staff
• Each client sees their own folder and nothing else, with no shared upload area
• An activity log you can export, showing who uploaded, viewed and downloaded what
• Encryption in transit and at rest, stated in writing by the vendor
• Retention and deletion you control, since a portal full of five-year-old tax documents is a liability, not an archive
• Staff sign-in through your Microsoft 365 accounts, so offboarding one person removes their portal access along with everything else
• Who answers the phone when a client can’t get in two days before a deadline

Plenty of firms don’t need one. A SharePoint site per client or engagement, shared with specific people, covers a lot of ground. One catch. File requests, the upload-only link that lets a client drop files into a folder without seeing what’s there, only work when Anyone links are switched on. Turn those off and file requests go too.

Matching the Method to the File

Most firms end up using all four. This is roughly how I’d split them.

What the Rules Ask an Accounting Firm For

Tax preparers count as financial institutions under the Gramm-Leach-Bliley Act, which puts them under the FTC Safeguards Rule. IRS Publication 4557 says so directly. The rule’s text at 16 CFR 314.4(c)(3) requires encrypting all customer information held or transmitted, both in transit over external networks and at rest. Where encryption is infeasible, the firm’s Qualified Individual can approve effective compensating controls instead. The exception for firms holding information on fewer than 5,000 consumers doesn’t touch that requirement.

Publication 4557 gets specific about email. If you must share files with clients that way, send only password-protected and encrypted documents, or use Secure File Transfer Protocol instead. There’s a reporting reason to care, too. A notification event under the rule is the unauthorized acquisition of unencrypted customer information, and one involving at least 500 consumers has to be reported to the FTC within 30 days of discovery.

Encrypted data changes that math. Mostly. If the key was exposed too, the rule treats the information as unencrypted.

Other kinds of firms answer to other rules, so check yours on its own terms. My team implements the controls. We don’t audit or certify anyone. My view on the frameworks is that “they’re all kind of based on the same things,” and file sharing proves it, since every one ends up asking whether the file was encrypted, who could open it, and whether you can show that. This is general information, not legal advice.

Licenses Decide Half of This

I make this point about Microsoft 365 constantly. “They build everything into 365. If you need to meet certain compliance frameworks, you have to purchase the right licence that gives you access to those features.” For file sharing, here’s where the lines fall.

Business Premium carries Purview Message Encryption, manual sensitivity labels, and data loss prevention for Exchange, SharePoint and OneDrive. That last one can be set to block Anyone links on files that contain, say, Social Security numbers, even when the person sharing didn’t notice. Basic and Standard get message encryption only through the add-on. The sharing settings themselves, link types, expiry and guest controls, come with SharePoint on Basic and Standard as well.

So a firm on Business Standard can fix most of its file sharing without buying another license. Encryption is where the license question starts, and it’s part of how we approach managing Microsoft 365 generally.

Questions Firms Ask About Sending Client Files