Keeping client documents where they belong

Most document exposure starts with a sign-in someone shouldn’t have had. This work tightens who can sign in to your Microsoft 365 tenant, from where, and with what proof.

• Multi-factor sign-in for every account, with a registration plan for staff
• Conditional Access policies, such as blocking older sign-in methods
• Separate administrator accounts and emergency-access accounts
• A review of Defender settings for email phishing and device protection, matched to the licences you hold

Client files often end up in a shared drive where everyone can see everything. This work gives each client relationship a defined place, and decides who can open it.

• A SharePoint structure for client files, organised by client or household
• Access granted to teams through groups, not to individuals one by one
• External sharing for document exchange with clients, using links that expire
• A quarterly access review that a named person can run

Labels tell people, and Microsoft 365, how a document should be handled. A short, clear scheme is far more likely to be used than a detailed one.

• A sensitivity label scheme in Purview, for example Internal, Client Confidential and Restricted
• Default labels on client document libraries
• Data loss prevention policies that warn before likely account or identity numbers are sent outside the firm, where your licences include it
• A one-page staff guide to choosing a label

Your firm decides how long each type of record must be kept. This work makes Microsoft 365 apply those periods consistently, instead of relying on people remembering not to delete things.

• Retention labels and policies built from the schedule your firm provides
• Email and client-file retention applied to the right locations
• A review step before records are deleted at the end of their period
• A written record of what was configured, and where