# SharePoint as a virtual data room: what it covers and misses

> SharePoint permissions, audit logs and labels cover most data-room needs. How to set one up in 7 steps, and where a paid VDR still wins.

[Home](https://tenantcraft.ca/)  [Insights](https://tenantcraft.ca/insights)  SharePoint

Govern Oct 17, 2026  10 min read

## SharePoint as a virtual data room: what it covers, what it doesn't

A buyer, auditor or lender wants your confidential files in a data room. The Microsoft 365 tenant you already pay for covers most of it: named access, view-only links and an audit trail. It can't tell you how long someone read page 14, and that's where a paid data room still earns its fee.

Geri Crroj

Microsoft 365 consultant, Niagara, Ontario

Tested in a live tenant, October 16, 2026

**Applies to:** SharePoint Online, Microsoft Purview Audit, Microsoft Purview sensitivity labels

You’re selling the business, refinancing, or going through an audit. The other side sends a list: financials, contracts, leases, payroll summaries. They want it in a “data room”, and the quote for one lands in your inbox the same week your software renewals do.

Before you sign, check whether the Microsoft 365 tenant you already pay for can do the job.

For most small deals, mostly yes. SharePoint can give named people view-only access to a set of folders, stop downloads, and log who opened what. What it can’t do is tell you how long the buyer’s lawyer spent reading the lease. That kind of tracking is what dedicated data rooms are built around.

Below you’ll find the three ways to run a data room and how to pick one, then a **7-step setup** with a screenshot for every step. You can build it this afternoon.

The 5-minute version

1.  **Build a separate site for the deal.** Don’t share from your everyday team site.
2.  **Open only that site to guests.** Leave the rest of your tenant as it is.
3.  **Share folders with “People you choose” and “Can’t download”.** Recipients sign in as themselves and can view, but not save.
4.  **Check that the audit log is recording** before the first guest signs in. In my test tenant, it wasn’t.
5.  **Pay for a data room if they want reading-time reports.** SharePoint logs opens and downloads, not minutes per page.

## What a data room has to do

Without the marketing, a virtual data room does four jobs.

-   **Lets only named people in.** Not anyone who gets forwarded a link.
-   **Stops files leaving.** View, yes. Download, print and forward, ideally no.
-   **Keeps a trail.** Who opened which file, and when.
-   **Ends cleanly.** When the deal closes or dies, access stops.

SharePoint can do all four. The difference is how much you set up yourself, and how detailed the trail is.

## Option 1: A dedicated site with “People you choose” links

One SharePoint site for the deal, one folder per topic, each folder shared with only the people who need it. It works on every Microsoft 365 business plan, and it’s what the 7 steps below build.

Microsoft calls these Specific people links “nontransferable”. If the buyer forwards the link, it doesn’t work for whoever they sent it to.

### Pros:

-   **No extra cost:** Guest sharing and view-only links come with SharePoint on every business plan.
-   **Named access:** Every person signs in as themselves, so each open is tied to a real account.

### Cons and hidden traps:

-   **No password on these links:** In SharePoint, link passwords come with Anyone links. Those skip sign-in, and Microsoft says access through them “can’t be audited”. For a data room, sign-in beats a password.
-   **Guests can linger:** Unless you turn on guest expiry (step 3), a guest keeps access after the deal ends.
-   **View-only isn’t screenshot-proof:** Can’t download removes the save button. It doesn’t stop a phone camera.

## Option 2: Option 1, plus the audit log and sensitivity labels

Same site, same steps, plus two Microsoft Purview tools: the audit log as your access report, and sensitivity labels that mark and lock the files themselves.

**The audit log.** Audit (Standard) is included in Microsoft 365 Business Basic, Standard and Premium, and keeps records for 180 days. You can search the deal site for **Accessed file**, **Downloaded file** and **Shared file, folder, or site**, then export the results to a CSV for the other side. Sharing events show who the item was shared with, and whether they’re a member or a guest.

**Sensitivity labels.** A label can stamp a header, footer or watermark on Office files. With encryption on, it can also block copying, printing and forwarding. The strongest option is a **dynamic watermark**: Microsoft puts the email of the person opening the file “on each page of the file”, and it stays when printed. Manual sensitivity labeling is included in Microsoft 365 Business Premium and E3, but not in Business Basic or Business Standard.

### Pros:

-   **A real access trail:** Who opened, downloaded and shared each file, by name, for 180 days.
-   **Protection that travels with the file:** An encrypted label still applies after the file leaves the site.

### Cons and hidden traps:

-   **The log groups repeat opens:** Microsoft logs **Accessed file** once per person per file every five minutes. It tells you someone opened the file, not how long they read it.
-   **Labels need the right plan:** On Business Standard, labels mean an upgrade.
-   **Dynamic watermarks can block old Office apps:** Microsoft warns that versions without support won’t open the file at all. Test with the other side first.

## Option 3: A paid virtual data room

When the other side asks for page-by-page reading reports, a formal Q&A log, or a numbered index of every document, you’ve moved past what SharePoint does.

Field note: check the audit list before you promise a report

Microsoft’s list of audited SharePoint activities covers opening, downloading, sharing and changing files. There’s no activity for time spent on a page or a file. If a buyer’s adviser asks “which pages did they read, and for how long”, SharePoint’s honest answer is “we can’t tell you”. Find this out before you agree to their data room terms, not after.

### Pros:

-   **Detailed reading analytics:** This is the feature dedicated data rooms are built around.
-   **Deal workflows built in:** Q&A threads, bulk permissions and closing archives come ready to use.

### Cons and hidden traps:

-   **Another subscription:** You pay for a second place to store files you already store in Microsoft 365.
-   **Another copy to clean up:** When the deal ends, there’s a second set of confidential files to delete or archive.

## Side-by-side comparison

|  | Option 1: Site + named links | Option 2: Plus audit log and labels | Option 3: Paid data room |
| --- | --- | --- | --- |
| **Extra licence** | None | Business Premium or E3 for labels | Separate subscription |
| **Named sign-in** | Yes | Yes | Yes |
| **Block downloads** | Yes, Can’t download | Yes, plus encryption | Yes |
| **Who opened what** | Basic, via the audit log | Yes, 180 days, exportable | Yes |
| **Reading time per page** | No | No | Yes |
| **Watermark with viewer’s email** | No | Yes, dynamic watermark | Usually |

## Which one should you pick?

-   **Choose Option 1 if** it’s a small deal, a handful of outside people need to read documents, and nobody has asked for an access report.
-   **Choose Option 2 if** a lender or auditor wants proof of who saw what, or the documents are sensitive enough that you want each reader’s email stamped on every page.
-   **Choose Option 3 if** the buyer’s advisers require reading-time reports, or there are many bidders at once.

If you picked Option 1 or 2, here’s the build.

## Set it up in 7 steps

You need to be a SharePoint or Global admin for steps 2, 3 and 6. Budget about 30 minutes.

### Step 1: Create a new site for the deal

In SharePoint, select **Build** in the left rail, then select **Site** under **Start building**. Give it a plain name, like “Project Maple data room”. Don’t reuse a team site your staff already work in.

![The SharePoint Build page. Under Start building there are four cards: Site, List, Document library and Agent. The Site card, which reads Create a shared space to collaborate or communicate across your organization, is ringed.](https://tenantcraft.ca/images/vdr-04-build-site.png)

SharePoint > Build > Start building

Start from Site. A fresh site means no old permissions come along with it.

### Step 2: Open only this site to guests

Go to the SharePoint admin center, select **Sites** > **Active sites**, and select your new site’s name. Open the **Settings** tab. Under **External file sharing**, choose **New and existing guests**, then select **Save**.

That setting means outsiders have to sign in, or enter a code sent to their email. In my test tenant, my everyday site was set to **Only people in your organization**, and that’s the right setting for every site except the data room.

![The Settings tab for a site in the SharePoint admin center. The External file sharing dropdown is open, showing Anyone, New and existing guests, Existing guests and Only people in your organization. New and existing guests is ringed.](https://tenantcraft.ca/images/vdr-05-site-sharing.png)

Admin center > Active sites > your site > Settings

Pick New and existing guests for the deal site only. Never Anyone.

If **New and existing guests** is greyed out, your tenant-wide setting is stricter than the site. Go to **Policies** > **Sharing** and move the **SharePoint** slider up to at least **New and existing guests**. Each site can then be set the same or tighter.

![The SharePoint admin center Sharing page. Two sliders for SharePoint and OneDrive run from Anyone, most permissive, through New and existing guests and Existing guests, down to Only people in your organization.](https://tenantcraft.ca/images/vdr-01-sharing-levels.png)

Admin center > Policies > Sharing

The tenant-wide ceiling. A site can't be more open than this.

### Step 3: Make guest access expire

On the same **Policies** > **Sharing** page, expand **More external sharing settings** and change two boxes:

1.  **Tick** **Guest access to a site or OneDrive will expire automatically after this many days**, and set the number of days your deal needs.
2.  **Untick** **Allow guests to share items they don’t own**. In my test tenant it was ticked, which would let a guest pass your files on.

Select **Save** at the bottom of the page.

![More external sharing settings in the SharePoint admin center. Allow guests to share items they don't own is ticked. Guest access to a site or OneDrive will expire automatically after this many days is unticked and ringed, with 60 greyed out beside it.](https://tenantcraft.ca/images/vdr-06-guest-expiry.png)

Admin center > Policies > Sharing > More external sharing settings

Here, guest expiry was off and guests could reshare. Flip both before the deal starts.

### Step 4: Make one folder per topic

In the new site’s **Documents** library, create a folder for each part of the deal, like **Financials**, **Legal** and **HR**. Upload the files into them. Folders let you give the lender the financials without also giving them payroll.

### Step 5: Share each folder, view only

For each folder:

1.  Select the folder, then select **Share**.
2.  Select the gear icon next to **Copy link** to open **Link settings**.
3.  Under **The link works for**, choose **People you choose**.
4.  Under **More settings**, open the permission menu and choose **Can’t download**.
5.  Select **Apply**.
6.  Type the outside person’s email address, add a short message, and select **Send**.

![The Link settings dialog for a folder. People you choose is selected, and the permission menu is open with Can edit, Can view and Can't download. Can't download, described as Can view, but not download, is ringed.](https://tenantcraft.ca/images/vdr-02-cant-download.png)

Folder > Share > Link settings

People you choose plus Can't download: named sign-in, view only, no save button.

### Step 6: Check the audit log is recording

Go to the Microsoft Purview portal and open **Audit** > **Search**. If the search form works, run a test search for **Accessed file** on your new site.

If you see a **Start recording user and admin activity** button instead, the trail isn’t there yet. That’s what my test tenant showed: every search field was greyed out. Turn recording on before the first guest signs in, because the log can’t show anything from before it was on.

![The Microsoft Purview Audit Search page. A message reads: Sorry, we're having trouble figuring out if activity is being recorded. A blue Start recording user and admin activity button is ringed, and the search fields below it are greyed out.](https://tenantcraft.ca/images/vdr-03-audit-not-recording.png)

Microsoft Purview > Audit > Search

If you see this button, there's no access trail yet. Fix it before you send the first invitation.

### Step 7: Close it when the deal ends

When the deal closes or falls through, export the audit search to a CSV for your records. Then go back to the site in **Active sites** and set **External file sharing** to **Only people in your organization**. That cuts off every guest at once. Microsoft says guests “typically lose access within one hour”.

## What this does not fix

-   **Reading-time tracking.** The audit log has no event for it, and no setting adds one.
-   **A determined reader with a camera.** View-only and watermarks deter copying. They don’t prevent it.
-   **Records older than 180 days.** Audit (Standard) drops them. If the deal runs longer, export the log as you go, or look at Audit (Premium), which keeps SharePoint records for one year.
-   **Sharing your everyday team site by mistake.** A separate site is what keeps deal files apart from the rest of the business.

## Read next

-   [How to find every SharePoint site with broken permission inheritance](https://tenantcraft.ca/insights/find-broken-permission-inheritance): check who already has access before you put deal files anywhere.
-   [One SharePoint site per client? Add a hub so people can find things](https://tenantcraft.ca/insights/sharepoint-hub-site-one-site-per-client): the same one-site-per-purpose idea, for client work.
-   [Turn on Copilot without leaking your HR folder](https://tenantcraft.ca/insights/copilot-without-leaking-hr): Specific people links make files searchable by Copilot for everyone on the link.

## Need a second set of eyes on your setup?

The 7 steps take about 30 minutes if you’ve done them before. The first time, the slow part is getting site sharing, guest expiry and audit recording right before outside people arrive.

-   **Want it set up or checked once?** An [hour bank](https://tenantcraft.ca/pricing) starts at $140 CAD per hour, in banks of 5, 10 or 25 hours, with no expiry.
-   **Questions first?** Email [hello@tenantcraft.ca](mailto:hello@tenantcraft.ca) with what the other side is asking for, and I’ll tell you which option fits.

A data room only works if you know who already has access to what. Start there.

Permissions Cleanup & Governance Prep Checklist

PDF · 7 pages · 45 checkpoints

[Email me the PDF](https://tenantcraft.ca/resources/guides/permissions-cleanup-prep)

TWENTY MINUTES

## Tell me what is stuck. I will tell you what it takes.

Same consultant from the first email to the last cutover.

[Book a 20-min call](https://tenantcraft.ca/contact) [See published rates](https://tenantcraft.ca/pricing)

---

_Canonical HTML: https://tenantcraft.ca/insights/sharepoint-virtual-data-room · Agent guide: https://tenantcraft.ca/llms.txt · Site map: https://tenantcraft.ca/sitemap-index.xml_