--- title: SharePoint as a Data Room (2026): Setup, Guest Access, Watermarks and Audit Log url: https://www.helprange.com/insight/2026/11/07/sharepoint-data-room --- [Insight](https://www.helprange.com/insight/) # SharePoint as a Data Room (2026): Setup, Guest Access, Watermarks and Audit Log Updated 7 November 2026 · HelpRange **Short answer:** SharePoint can work as a data room if your company already runs Microsoft 365 and the deal is simple. Use a dedicated site per deal, invite guests to "specific people" links, apply "can't download" and guest expiry, and read the Purview audit log afterwards. The deal features are spread across licences and admin settings: - **NDA before access** needs Microsoft Entra Terms of Use (Entra ID P1). - A **watermark with the viewer's e-mail** needs E5-level sensitivity labels with encryption, and works for Word, Excel and PowerPoint only. - **Site-wide download blocking** needs SharePoint Advanced Management. There is no time per page and no Q&A. This guide walks through the setup in Microsoft's own terms and links to the documentation for each step. Based on Microsoft Learn and Microsoft Support documentation, read on 7 November 2026. Microsoft changes sharing settings often (e.g. the SharePoint one-time passcode retirement in 2026) – follow the linked pages. Disclosure: HelpRange is our product. ## What SharePoint gives you as a data room | Data room need | In SharePoint | Licence | |---|---|---| | Separate space per deal | A dedicated site with external sharing on | Any Microsoft 365 plan with SharePoint | | Invite outside parties | Guests via Microsoft Entra B2B; "specific people" links | Included | | View without download | "Can't download" on a share; site-wide block download policy | Share option included; site policy needs SharePoint Advanced Management | | Access ends automatically | Guest access expiration after N days | Included | | NDA before access | Entra Terms of Use via Conditional Access | Entra ID P1 ($7/user/month) | | Watermark with viewer's e-mail | Dynamic watermark on encrypted sensitivity labels – Office files only | E5-level (Purview) | | Who opened / downloaded what | Purview audit log (FileAccessed, FileDownloaded) | Standard: 180 days; Premium (E5): 1 year | | Time per page, heatmaps | No – site usage shows time only for pages and news, not documents | – | | Q&A | No native module | – | Sources are linked in the steps below. Entra ID price from [Microsoft Entra pricing](https://www.microsoft.com/en-us/security/business/microsoft-entra-pricing) (annual subscription); Microsoft 365 plan prices vary by plan and region – see Microsoft's pricing pages. ## How to set up a SharePoint data room: 8 steps 1. **Create a separate site for the deal.** Microsoft recommends keeping confidential information "in a site that has external sharing turned off" and creating "additional sites as needed to use for external sharing" ([sharing and permissions](https://learn.microsoft.com/en-us/sharepoint/modern-experience-sharing-permissions)). One deal, one site – never your intranet. 2. **Choose the site type with permissions in mind.** Team sites are managed through a Microsoft 365 group, which has no view-only role; read-only outsiders must be added to the site's Visitors group. A communication site uses Owners / Members / Visitors directly and is easier for read-only rooms (same page). 3. **Set external sharing for the site.** In the SharePoint admin center choose "New and existing guests" or "Existing guests" – avoid "Anyone" for deal documents, because Anyone links "don't have to authenticate, and their access can't be audited". Limit sharing to the counterparties' domains if you know them ([external sharing](https://learn.microsoft.com/en-us/sharepoint/turn-external-sharing-on-or-off)). 4. **Build the folder index** – numbered folders (01 Corporate, 02 Financials…). Start from our [due diligence checklists](https://www.helprange.com/due-diligence-checklist). 5. **Give access per party.** Put each bidder's people in their own SharePoint group with Read or View Only permission. Stopping inheritance on folders is possible, but Microsoft advises default groups because it "makes administration easier", and very large libraries cannot break inheritance at all ([permission levels](https://learn.microsoft.com/en-us/sharepoint/understanding-permission-levels)). If bidders must see different folders, a site per bidder is often simpler. 6. **Restrict downloads and set expiry.** When sharing, "Can't download" stops downloads for that share ([share files](https://support.microsoft.com/en-us/office/share-sharepoint-files-or-folders-1fe37332-0f9a-4719-970e-d2578da4941c)). A site-wide block download policy (browser-only, no download, print or sync) needs SharePoint Advanced Management ([block download](https://learn.microsoft.com/en-us/sharepoint/block-download-from-sites)). Turn on guest access expiration so access ends after a set number of days ([guest expiration](https://support.microsoft.com/en-us/office/manage-guest-expiration-for-a-site-25bee24f-42ad-4ee8-8402-4186eed74dea)). 7. **Require an NDA (optional).** SharePoint has no click-through agreement. The workaround is Entra Terms of Use: upload your NDA as a PDF and enforce it with Conditional Access for guests; you get an accept/decline report ([terms of use](https://learn.microsoft.com/en-us/entra/identity/conditional-access/terms-of-use)). It applies tenant-wide policies, not one NDA per deal site by default. 8. **Invite guests and check the audit log.** Guests receive an account in your directory through Entra B2B and sign in with their e-mail (one-time passcode) ([B2B integration](https://learn.microsoft.com/en-us/sharepoint/sharepoint-azureb2b-integration)). Afterwards, search the Purview audit log for FileAccessed and FileDownloaded events ([audit activities](https://learn.microsoft.com/en-us/purview/audit-log-activities)). ## Watermarks in SharePoint: what really works Microsoft Purview sensitivity labels with encryption can add a **dynamic watermark**: the viewer's user name (usually the e-mail) is inserted on each page when they open the file. Limits from Microsoft's documentation ([encryption labels](https://learn.microsoft.com/en-us/purview/encryption-sensitivity-labels), [supported versions](https://learn.microsoft.com/en-us/purview/sensitivity-labels-versions)): - Only Word, Excel and PowerPoint – not PDFs, which are most of a data room. - Only with labels that apply encryption; configuring it is listed for E5-level licences. - In Office for the web, encrypted files cannot be printed or downloaded, but screen captures are not prevented. - Admins must enable sensitivity labels for SharePoint and OneDrive first, or encrypted files lose web viewing and search. ## Audit log and analytics - **Audit (Standard)** keeps records 180 days; **Audit (Premium)**, on E5, keeps SharePoint records for a year ([audit solutions](https://learn.microsoft.com/en-us/purview/audit-solutions-overview)). Export the deal's records before they age out. - FileAccessed is not logged again for the same user and file within five minutes – you see that someone opened a file, not how long they read it. - Site usage shows visitors and visits, including guests; "average time spent" covers pages and news posts, not documents ([site usage](https://support.microsoft.com/en-us/office/view-usage-data-for-your-sharepoint-site-2fa8ddc2-c4b3-4268-8d26-a772dc55779e)). ## When SharePoint is enough – and when it is not | Situation | SharePoint? | |---|---| | One known counterparty, your IT team helps, mostly Office files | Usually fine | | Several bidders who must not see each other | Possible with a site or group per bidder – plan carefully | | Most documents are PDFs and you need a watermark per viewer | Not with built-in features | | You need an NDA per deal and a record of who signed | Only via Entra Terms of Use (P1), tenant-level | | You want to know which pages a buyer read | No | ## Or in HelpRange If the deal needs per-viewer watermarks on PDFs, an NDA per room and reading analytics, HelpRange does that without changing your Microsoft 365 setup: - A data room per party; guests verify by e-mail code – no directory accounts, no IT tickets. - Click-to-sign NDA per room before the first document opens, with a PDF record of e-mail, time and IP. - Watermark with each viewer's e-mail on every page of PDFs, Office files and images; download/print blocking and screenshot protection per room. - Time per page, heatmaps and visit replays; a guest activity report per room (page or CSV). - AI answers for guests from the room's documents (no human Q&A workflow); data stored in the EU (Frankfurt). - $174 a month per team with unlimited users and guests, or $199 once for a 90-day [Deal Room Pass](https://www.helprange.com/deal-room-pass). [HelpRange as a SharePoint alternative for external sharing](https://www.helprange.com/sharepoint-alternative) · [Open the demo data room](https://www.helprange.com/demo) ## FAQ ### Can SharePoint be used as a virtual data room? Yes, for simple deals: a dedicated site, guest access through Entra B2B, "can't download" shares, guest expiry and the Purview audit log. NDA gates, per-viewer watermarks and site-wide download blocking need extra licences, and there is no page-level analytics or Q&A. ### Can SharePoint add a watermark with the viewer's e-mail? Only for Word, Excel and PowerPoint files protected by an encrypting sensitivity label with dynamic watermarking, which Microsoft lists for E5-level licences. PDFs are not covered. ### How do I make guests accept an NDA in SharePoint? Use Microsoft Entra Terms of Use with Conditional Access (Entra ID P1): guests must accept your PDF terms before access, and you get an acceptance report. ### How long does SharePoint keep audit logs? 180 days with Audit (Standard) and one year with Audit (Premium) on E5, longer with an add-on. ### Can I see how long a guest read a document in SharePoint? No. The audit log shows that a file was accessed or downloaded; site usage reports time only for pages and news posts, not documents. Related: [Box as a data room](https://www.helprange.com/insight/2026/11/07/box-data-room/) · [Dropbox and DocSend as a data room](https://www.helprange.com/insight/2024/03/16/using-dropbox-as-a-data-room/) · [how to set up a data room](https://www.helprange.com/insight/2024/03/08/setting-up-a-data-room/) · [data rooms with heatmaps and audit logs](https://www.helprange.com/insight/2026/11/07/data-room-heatmaps-audit-logs/). ## More guides - [Virtual Data Room Cost (2026): Pricing Models, Real Prices and Hidden Fees](https://www.helprange.com/insight/2024/06/12/virtual-data-room-cost/) - [Data Room for One Deal or 3 Months (2026): One-Time vs Monthly Pricing Compared](https://www.helprange.com/insight/2026/11/06/data-room-for-one-deal/) - [CapLinked Pricing (2026): Team $399/Month, Enterprise and Real Deal Costs](https://www.helprange.com/insight/2026/11/07/caplinked-pricing/) - [Onehub Pricing (2026): Standard, Advanced and Data Room Edition Compared](https://www.helprange.com/insight/2026/11/07/onehub-pricing/) - [SecureDocs Pricing (2026): $250/Month Flat Fee, 3-Month Plan and What Is Included](https://www.helprange.com/insight/2026/11/07/securedocs-pricing/) - [ShareVault Pricing and Review (2026): Express, Pro and Enterprise Plans](https://www.helprange.com/insight/2026/11/07/sharevault-pricing/)