How a Community Bank Built One Files.com Portal to Replace SharePoint Guest Access, Box.com, and Secure Email

A mid-sized community bank runs a multi-branch network with commercial and industrial loans, commercial real estate, mortgages, and small business lending at the center of its business, sold on local expertise and direct access to decision-makers.

That kind of lending runs on documents. Throughout a complicated commercial loan, the lender and the client exchange tax returns, pay stubs, and financial statements. Every one of those documents is sensitive. And every one has to cross between the bank and a client who is not a user in any bank system and cannot be assumed to be good with technology.

Three Channels, Each With Its Own Friction

The bank had three channels for that exchange, and each added friction. Secure email notifications arrived from a third-party service rather than from the bank, so clients hesitated before opening them, and lenders spent time walking clients through legitimate mail. Ad hoc submissions ran through a Box.com page that carried no bank branding.

The channel built for ongoing exchange was a set of external-facing SharePoint sites with guest access, and keeping a guest's access working took a 20-to-30-minute wipe-and-reinvite fix. Then Microsoft changed SharePoint's alerting, and the bank found itself writing Power Automate scripts just to know a client had uploaded a file. The bank wanted one branded path for every client document, with nothing for the client to install or remember and every upload announced to the lender the moment it landed.

No Passwords for Clients, No Second Admin System for the Bank

A replacement had to work for a non-technical client with nothing to install and no password to forget. A forwarded link could not open for anyone but the invited recipient. The lender needed to know the moment a client uploaded, the lender's assistant needed access to the same workspace, and the exchange could never quietly become permanent storage of client tax records. It also could not hand the bank a second user-administration system to run alongside its directory. And the hardest requirement was not technical at all: roughly a hundred staff members had to prefer the new path, which meant it had to be easier than the email it replaced.

The bank selected Files.com to be that portal.

A Branded Client Portal Provisioned From Entra ID Groups

Files.com gave the bank an external exchange it administers from the directory it already manages, with SharePoint remaining as the storage behind the lender workflow. The site authenticates through Entra ID SAML SSO, and SCIM provisioning mirrors the directory into Files.com. Adding a lender to an Entra ID group creates their account, and a Files.com folder behavior automatically creates that lender's client workspace with permissions already set. Access administrators keep working in the one place they already work: putting people into groups. Removal runs the same way. Take a user out of the group and their share links are revoked automatically, with nothing left to shut off by hand.

The client's side of the exchange is a share link that opens a page on the bank's own domain, under the bank's own branding. Instead of a password, the link uses an email one-time passcode. The bank chose that deliberately: clients forget passwords, and a code sent to the invited address means a forwarded link opens for nobody else. Lenders share the workspace with the client and with their own assistant, and email notifications tell the lender the moment a document arrives.

Governance is enforced by the platform rather than by anyone's diligence. Files are deleted by policy after a set retention period.

A recycle bin backstops mistakes. A handful of the bank's more technically confident lenders piloted the workspaces over roughly three weeks before the wider rollout.

One Governed Channel Designed to Replace Three

The pilot established one governed pattern for the client exchanges the bank had handled through secure email, SharePoint guest access, and an unbranded Box.com page.

• A client delivering a tax return follows a link on the bank's own domain and enters a code sent to their own inbox. The page carries the bank's name, and there is no password to forget or reset.
• Guest access is out of the client's path, and the 20-to-30-minute wipe-and-reinvite fix goes with it. Access is group membership, so an access problem is a group edit.
• The lender's upload alert is a built-in notification, not a Power Automate script somebody has to write and maintain.
• Retention enforces itself. Files are deleted by policy after a set retention period, so the exchange carries the loan without becoming a permanent store of client financials, and nobody purges folders by hand.

The pattern also compounds, because it is a template rather than a lending feature. Other teams at the bank use the same pattern for their own outside exchanges, and standing it up for another team is a group and a folder behavior, not a new system.

Exchange That Administers Itself

Instead of asking clients to work across secure email, SharePoint guest access, and an unbranded Box.com page, the bank built one branded, passwordless Files.com portal that administrators could provision through Entra ID and govern with automatic retention.