Applies to: SharePoint Online, Microsoft Purview Audit, Microsoft Purview sensitivity labels
You’re selling the business, refinancing, or going through an audit. The other side sends a list: financials, contracts, leases, payroll summaries. They want it in a “data room”, and the quote for one lands in your inbox the same week your software renewals do.
Before you sign, check whether the Microsoft 365 tenant you already pay for can do the job.
For most small deals, mostly yes. SharePoint can give named people view-only access to a set of folders, stop downloads, and log who opened what. What it can’t do is tell you how long the buyer’s lawyer spent reading the lease. That kind of tracking is what dedicated data rooms are built around.
Below you’ll find the three ways to run a data room and how to pick one, then a 7-step setup with a screenshot for every step. You can build it this afternoon.
What a data room has to do
Without the marketing, a virtual data room does four jobs.
- Lets only named people in. Not anyone who gets forwarded a link.
- Stops files leaving. View, yes. Download, print and forward, ideally no.
- Keeps a trail. Who opened which file, and when.
- Ends cleanly. When the deal closes or dies, access stops.
SharePoint can do all four. The difference is how much you set up yourself, and how detailed the trail is.
Option 1: A dedicated site with “People you choose” links
One SharePoint site for the deal, one folder per topic, each folder shared with only the people who need it. It works on every Microsoft 365 business plan, and it’s what the 7 steps below build.
Microsoft calls these Specific people links “nontransferable”. If the buyer forwards the link, it doesn’t work for whoever they sent it to.
Pros:
- No extra cost: Guest sharing and view-only links come with SharePoint on every business plan.
- Named access: Every person signs in as themselves, so each open is tied to a real account.
Cons and hidden traps:
- No password on these links: In SharePoint, link passwords come with Anyone links. Those skip sign-in, and Microsoft says access through them “can’t be audited”. For a data room, sign-in beats a password.
- Guests can linger: Unless you turn on guest expiry (step 3), a guest keeps access after the deal ends.
- View-only isn’t screenshot-proof: Can’t download removes the save button. It doesn’t stop a phone camera.
Option 2: Option 1, plus the audit log and sensitivity labels
Same site, same steps, plus two Microsoft Purview tools: the audit log as your access report, and sensitivity labels that mark and lock the files themselves.
The audit log. Audit (Standard) is included in Microsoft 365 Business Basic, Standard and Premium, and keeps records for 180 days. You can search the deal site for Accessed file, Downloaded file and Shared file, folder, or site, then export the results to a CSV for the other side. Sharing events show who the item was shared with, and whether they’re a member or a guest.
Sensitivity labels. A label can stamp a header, footer or watermark on Office files. With encryption on, it can also block copying, printing and forwarding. The strongest option is a dynamic watermark: Microsoft puts the email of the person opening the file “on each page of the file”, and it stays when printed. Manual sensitivity labeling is included in Microsoft 365 Business Premium and E3, but not in Business Basic or Business Standard.
Pros:
- A real access trail: Who opened, downloaded and shared each file, by name, for 180 days.
- Protection that travels with the file: An encrypted label still applies after the file leaves the site.
Cons and hidden traps:
- The log groups repeat opens: Microsoft logs Accessed file once per person per file every five minutes. It tells you someone opened the file, not how long they read it.
- Labels need the right plan: On Business Standard, labels mean an upgrade.
- Dynamic watermarks can block old Office apps: Microsoft warns that versions without support won’t open the file at all. Test with the other side first.
Option 3: A paid virtual data room
When the other side asks for page-by-page reading reports, a formal Q&A log, or a numbered index of every document, you’ve moved past what SharePoint does.
Pros:
- Detailed reading analytics: This is the feature dedicated data rooms are built around.
- Deal workflows built in: Q&A threads, bulk permissions and closing archives come ready to use.
Cons and hidden traps:
- Another subscription: You pay for a second place to store files you already store in Microsoft 365.
- Another copy to clean up: When the deal ends, there’s a second set of confidential files to delete or archive.
Side-by-side comparison
| Option 1: Site + named links | Option 2: Plus audit log and labels | Option 3: Paid data room | |
|---|---|---|---|
| Extra licence | None | Business Premium or E3 for labels | Separate subscription |
| Named sign-in | Yes | Yes | Yes |
| Block downloads | Yes, Can’t download | Yes, plus encryption | Yes |
| Who opened what | Basic, via the audit log | Yes, 180 days, exportable | Yes |
| Reading time per page | No | No | Yes |
| Watermark with viewer’s email | No | Yes, dynamic watermark | Usually |
Which one should you pick?
- Choose Option 1 if it’s a small deal, a handful of outside people need to read documents, and nobody has asked for an access report.
- Choose Option 2 if a lender or auditor wants proof of who saw what, or the documents are sensitive enough that you want each reader’s email stamped on every page.
- Choose Option 3 if the buyer’s advisers require reading-time reports, or there are many bidders at once.
If you picked Option 1 or 2, here’s the build.
Set it up in 7 steps
You need to be a SharePoint or Global admin for steps 2, 3 and 6. Budget about 30 minutes.
Step 1: Create a new site for the deal
In SharePoint, select Build in the left rail, then select Site under Start building. Give it a plain name, like “Project Maple data room”. Don’t reuse a team site your staff already work in.
SharePoint > Build > Start building
Start from Site. A fresh site means no old permissions come along with it.
Step 2: Open only this site to guests
Go to the SharePoint admin center, select Sites > Active sites, and select your new site’s name. Open the Settings tab. Under External file sharing, choose New and existing guests, then select Save.
That setting means outsiders have to sign in, or enter a code sent to their email. In my test tenant, my everyday site was set to Only people in your organization, and that’s the right setting for every site except the data room.
Admin center > Active sites > your site > Settings
Pick New and existing guests for the deal site only. Never Anyone.
If New and existing guests is greyed out, your tenant-wide setting is stricter than the site. Go to Policies > Sharing and move the SharePoint slider up to at least New and existing guests. Each site can then be set the same or tighter.
Admin center > Policies > Sharing
The tenant-wide ceiling. A site can't be more open than this.
Step 3: Make guest access expire
On the same Policies > Sharing page, expand More external sharing settings and change two boxes:
- Tick Guest access to a site or OneDrive will expire automatically after this many days, and set the number of days your deal needs.
- Untick Allow guests to share items they don’t own. In my test tenant it was ticked, which would let a guest pass your files on.
Select Save at the bottom of the page.
Admin center > Policies > Sharing > More external sharing settings
Here, guest expiry was off and guests could reshare. Flip both before the deal starts.
Step 4: Make one folder per topic
In the new site’s Documents library, create a folder for each part of the deal, like Financials, Legal and HR. Upload the files into them. Folders let you give the lender the financials without also giving them payroll.
Step 5: Share each folder, view only
For each folder:
- Select the folder, then select Share.
- Select the gear icon next to Copy link to open Link settings.
- Under The link works for, choose People you choose.
- Under More settings, open the permission menu and choose Can’t download.
- Select Apply.
- Type the outside person’s email address, add a short message, and select Send.
Folder > Share > Link settings
People you choose plus Can't download: named sign-in, view only, no save button.
Step 6: Check the audit log is recording
Go to the Microsoft Purview portal and open Audit > Search. If the search form works, run a test search for Accessed file on your new site.
If you see a Start recording user and admin activity button instead, the trail isn’t there yet. That’s what my test tenant showed: every search field was greyed out. Turn recording on before the first guest signs in, because the log can’t show anything from before it was on.
Microsoft Purview > Audit > Search
If you see this button, there's no access trail yet. Fix it before you send the first invitation.
Step 7: Close it when the deal ends
When the deal closes or falls through, export the audit search to a CSV for your records. Then go back to the site in Active sites and set External file sharing to Only people in your organization. That cuts off every guest at once. Microsoft says guests “typically lose access within one hour”.
What this does not fix
- Reading-time tracking. The audit log has no event for it, and no setting adds one.
- A determined reader with a camera. View-only and watermarks deter copying. They don’t prevent it.
- Records older than 180 days. Audit (Standard) drops them. If the deal runs longer, export the log as you go, or look at Audit (Premium), which keeps SharePoint records for one year.
- Sharing your everyday team site by mistake. A separate site is what keeps deal files apart from the rest of the business.
Read next
- How to find every SharePoint site with broken permission inheritance: check who already has access before you put deal files anywhere.
- One SharePoint site per client? Add a hub so people can find things: the same one-site-per-purpose idea, for client work.
- Turn on Copilot without leaking your HR folder: Specific people links make files searchable by Copilot for everyone on the link.
Need a second set of eyes on your setup?
The 7 steps take about 30 minutes if you’ve done them before. The first time, the slow part is getting site sharing, guest expiry and audit recording right before outside people arrive.
- Want it set up or checked once? An hour bank starts at $140 CAD per hour, in banks of 5, 10 or 25 hours, with no expiry.
- Questions first? Email hello@tenantcraft.ca with what the other side is asking for, and I’ll tell you which option fits.