ShareFile to SharePoint migration services
Citrix ShareFile was almost never bought as internal storage. Accounting, legal and healthcare firms bought it to exchange documents with people outside the firm — client portals, FileDrop links, request-a-file, folder templates per engagement, and a retention story the compliance officer could point at. That is the half a generic file migration ignores. Fixed-fee delivery from senior US-based Microsoft engineers: we rebuild the client-facing side as external SharePoint sites, guest access or a Power Pages portal before we touch a single internal folder. One written price, typical delivery in 2–4 weeks, 30 days of hypercare included.
Representative dashboard — sample data
What you get
Leaving an internal storage tool is a content project. Leaving a client-facing exchange is a client-access project first, and the content follows it.
The first inventory is not of folders, it is of people outside your firm: which clients, auditors, opposing counsel or referring providers can reach what today, and which of them still should. That list drives the whole design.
A ShareFile client portal has a real replacement in Microsoft 365, and there is more than one. We choose between an external-facing SharePoint site with guest access and a Power Pages portal on the evidence, and tell you why.
Inbound links are the ones that break quietly. Every live FileDrop, request-a-file and secure upload link is registered with its owner and expiry rule, then replaced with a SharePoint request link or intake form while the old one still works.
The per-engagement folder structure ShareFile stamped out for every new client is not lost. It is rebuilt as a SharePoint site template so opening a matter, engagement or case still provisions the same shape in one click.
Firms in regulated work bought ShareFile partly for the compliance posture. What that posture actually requires is written down, agreed with whoever owns it, then rebuilt with Purview retention policies and sensitivity labels — not left to lapse at cutover.
ShareFile is a per-user monthly subscription sitting on top of Microsoft 365 seats that already include SharePoint, OneDrive, Teams, external sharing and Purview. The project ends that overlap on a date named in the scope.
How it works
A free consultation plus a scan of your ShareFile account tells us which external people hold access, which links are live, which folder templates are in real use, and what retention is actually configured. Then the content. You get a written scope, a wave plan, one fixed price, and a cutover date.
Sites, libraries, site templates, Entra groups, guest or portal access and Purview policies are built to the agreed design. One real client relationship moves end to end — upload, download, notification, retention — so the external experience is proven on live work before anyone else is touched.
Remaining content moves wave by wave with validation at each step and a final pass that copies only what changed. Client access is reissued, staff and clients get short guides, ShareFile goes read-only on your schedule, and 30 days of hypercare follows.
Ask why a firm bought ShareFile and the answer is almost never “we needed somewhere to keep our files”. It is that a CPA firm needed clients to send a shoebox of tax documents securely, or a law firm needed to hand a closing binder to opposing counsel, or a practice needed to move records without emailing protected health information around. The internal file store was a side effect. That inversion is what makes this migration different from moving a team drive: the users you can least afford to disrupt do not work for you, cannot be trained in a lunch-and-learn, and will simply call your partners if a link fails.
So the first inventory is a list of external people and what they can reach, not a list of folders. Every client, auditor, adjuster, referring provider and contractor with access is identified, matched to an internal owner, and marked keep or drop — and the drop list is usually long, because access granted for one engagement in 2021 tends to persist. Only then does the folder inventory matter. Getting that order wrong is how firms discover, a fortnight after cutover, that a client has been unable to upload anything since the switch and never mentioned it.
The destination is the same Microsoft 365 tenant you already pay for, and Microsoft's external sharing model (opens in new tab) is the mechanism. What it is not is a like-for-like clone of ShareFile's portal, which is why the design decision below gets made deliberately rather than discovered late.
There are two honest answers and they suit different firms. Guest access invites the client into an external-facing SharePoint site as an authenticated guest in your directory: fast to stand up, works with the libraries your staff already use, and governed by the same sharing and conditional access policies (opens in new tab) as everything else. The trade is that a guest is an identity in your tenant and the experience looks like SharePoint, not like your firm.
A Power Pages portal (opens in new tab) is the other route: your branding, your login, a page that shows a client exactly their documents and their outstanding requests and nothing that hints at your internal structure, with table permissions (opens in new tab) deciding what each visitor can see. It costs more to build and it is a product you now own. Firms with a handful of long-running client relationships usually take guest access; firms whose portal is part of how they sell usually take the portal. We put both in front of you during scoping with the actual numbers from your inventory, and a mixed answer — portal for clients, guest access for professional counterparties — is common. If a portal is the direction, our Power Pages development services cover that build in its own right.
This is the working checklist we take into the inventory session. The right-hand column is the point: most rows need a decision from you before any copying starts, and the client-facing rows need it earliest, because they set the cutover date.
| In ShareFile | Where it lands in Microsoft 365 | Decided before the first pass |
|---|---|---|
| Client portals and shared client folders | An external-facing SharePoint site with Entra guest access, or a Power Pages portal with table permissions | Whether clients get a guest identity in your tenant or a branded portal with none — per client type, not once for everyone |
| FileDrop and request-a-file links | SharePoint file-request links into a specific library, or a portal intake form | Which links are live, who is on the other end, and which expiry or password rules have to survive |
| Folder templates for new engagements | SharePoint site templates and site designs (opens in new tab), applied when a matter or engagement is opened | Which template is the current standard, and which folders in it nobody has used in years |
| Custom folder access permissions | SharePoint permission levels granted to Entra security groups at site or library level, with inheritance intact | Which per-folder exceptions are real access control and which are historical accidents |
| Internal shared folders | Document libraries on team SharePoint sites, one per team or practice group that genuinely collaborates | Which top-level folders are live work, which are archive, and which should not move at all |
| Personal file space | The individual's OneDrive, with anything a client engagement depends on promoted into a shared library first | What is genuinely personal versus client work parked in one person's private space |
| Retention settings and compliance posture | Rebuilt as Microsoft Purview retention policies (opens in new tab) and retention labels | What your policy actually requires per record type, and who signs off that the rebuild matches it |
| Restricted or specially handled client data | Purview sensitivity labels (opens in new tab) on sites and documents, controlling encryption, download and re-sharing | Which client data classes need protection that travels with the file rather than the location |
| Signature requests | Microsoft 365 eSignature for PDFs in SharePoint (opens in new tab), or Power Automate to a provider such as Adobe Acrobat Sign (opens in new tab) | What genuinely goes out for signature, in what volume, and whether an external provider stays in the picture |
| Feedback, approval and custom workflows | Power Automate approvals writing back to the same library | Which workflows people actually run versus which were configured once and quietly abandoned |
| Activity and access reports | The Purview audit log (opens in new tab), with saved searches for the questions you currently answer from ShareFile reports | Which reports the compliance or risk team genuinely reads, and how far back they need to look |
| The content itself | SharePoint libraries, with unsupported names and characters (opens in new tab) cleaned first | The tooling path: a supported connector where one exists, otherwise a staged copy treated as file-share content |
On that last row, we confirm the tooling during inventory rather than assuming it. Where Microsoft's Migration Manager offers a supported connector for your source we use it; where it does not, the content is staged and moved as file-share content with the SharePoint Migration Tool (opens in new tab), which is included with your tenant and supports the incremental passes that make a low-drama cutover possible. Nothing in ShareFile is deleted by any of this — the migration copies, which is why the account can stay live through the waves and read-only afterwards.
The objection we hear most is not technical. It is a managing partner or compliance officer asking whether the record-keeping obligations the firm signed up to still hold after the move. It is a fair question, and the wrong answer is a reassuring shrug. Retention in ShareFile is a set of account and folder settings; retention in Microsoft 365 is a Purview policy or label applied to a site, a library or a record type. Those are different mechanisms, so the migration is the moment the policy gets re-read rather than re-copied.
What that looks like in practice: during inventory we write down each retention rule you rely on, in the words your policy uses, and note where it currently comes from. Whoever owns compliance confirms the list — often the first time it has been written out in one place. Then it is configured in Purview, applied to the destination, and tested on real documents in the pilot before any client content moves. Where a document class needs protection that travels with the file rather than with the folder, that becomes a sensitivity label instead. Firms in specific regulated work usually want a second pair of eyes on the whole tenant configuration too, which is what our Microsoft 365 tenant security assessment is for.
The commercial case tends to be what starts the conversation. ShareFile is billed per user per month, and for most firms it sits alongside Microsoft 365 licences that already include SharePoint Online, OneDrive, Teams, external sharing and Purview — capability the firm is paying for twice and using once. We are not going to quote you a saving here, because the honest figure depends on your seat count, your plan and your renewal terms, and you already have all three on an invoice. What we will do during scoping is set the migration timeline against your renewal date, so the overlap is a few planned weeks rather than another full year.
The overlap does not go to zero on cutover day, and any consultant who promises that is guessing. ShareFile stays live through the waves so that no client engagement is stranded mid-flight, then goes read-only for a reference window you choose. The scope names the date after which you can stop renewing, and that date is a commitment rather than a hope. The same reasoning behind the fee itself is set out in how our fixed-fee process works.
Most ShareFile exits sort into the same three phases. The table shows scope and typical timeline rather than prices, because an honest number requires seeing your external access list, your link register, your folder templates and your retention settings first. You get one written price for the whole project instead of an hourly meter that rewards a slow migration.
| Phase | Scope | Typical timeline | Fee |
|---|---|---|---|
| Phase 1 — External access audit and design | Inventory of every external person and what they can reach; the live link register; folder templates and permission exceptions catalogued; retention and classification rules written down and confirmed with their owner; the guest-versus-portal decision; target site, library and template design; a wave plan and cutover date | About 1 week | Fixed fee — scoped after your free consultation |
| Phase 2 — Pilot with a live client relationship | Destination sites, libraries, site templates, Entra groups, guest or portal access and Purview policies built; identities mapped; one real client engagement migrated end to end and exercised — upload, download, request, notification, retention — before anyone else moves | About 1 week | Fixed fee — scoped after your free consultation |
| Phase 3 — Waves, reissued access, ShareFile retirement | Remaining content migrated in waves with validation at each step and a final delta pass at cutover; client and counterparty access reissued; FileDrop and request links replaced; short guides for staff and for clients; ShareFile set read-only on your schedule; admin handover, then 30 days of included hypercare | 1–2 weeks, plus 30 days of hypercare | Fixed fee — scoped after your free consultation |
Everything lands in the tenant you own. The sites, libraries, templates, groups, labels, policies, documentation and admin access are yours throughout, so your team can carry on in-house the moment hypercare ends.
The usual fit is a professional firm of roughly 10 to 500 people — accounting and tax practices, law firms, healthcare providers, wealth managers, insurance and title work — already paying for Microsoft 365 while still paying ShareFile to do the client exchange those licences cover. It is scoped as one fixed-fee project with a stated end date, delivered by senior US-based engineers from our Orange County, CA base and remote across all US states. Law firms in particular tend to scope this alongside the matter-centric structure our SharePoint consultant for law firms engagement builds, because a client portal and a matter workspace are the same permission problem seen from two sides.
The source you are leaving changes the work far more than the destination does, and ShareFile is the outlier in this family. Box, Dropbox and Egnyte are internal storage platforms with external sharing bolted on; ShareFile is external exchange with internal storage attached, which is why the sequence here starts with people rather than folders. If your files sit in Box, the awkward parts are metadata templates, Relay workflows and Shield classifications — handled by our Box to SharePoint migration services. In Dropbox, it is team folder structure and the version-history gap, covered by our Dropbox to SharePoint migration services. Egnyte adds a second source of truth in the form of an on-premises Storage Sync appliance, which our Egnyte to SharePoint migration services reconcile alongside the cloud tenant. A records-management system is a different problem again: template metadata, retention schedules and workflow routing have to be rebuilt rather than copied, which is what our Laserfiche to SharePoint migration services are scoped around. Where the bulk archive never made it into ShareFile at all and is still on a server, the file server to SharePoint migration playbook covers that inventory and wave planning. Once content lands, our SharePoint intranet and document management consulting turns the new libraries into a workspace with navigation and governance behind it, and because Microsoft 365 Copilot can only be as safe as the permissions underneath it, firms planning a Copilot rollout want the guest and group clean-up finished first.
Related services
Metadata templates rebuilt as columns, Relay workflows recreated in Power Automate, Shield classifications translated.
Two sources reconciled at once — the cloud file system and the Storage Sync appliance still sitting in the server room.
Turn the migrated libraries into a structured intranet with navigation, metadata, and permissions people can follow.
Further reading
Hand-written guides from our article library.
The inventory, structure design, and cutover playbook for whatever never made it into the cloud tool.
Why permissions clean-up is the prerequisite nobody budgets for, and how to do it in the right order.
Why a scoped price beats an open meter when the work has a hard cutover date attached.
FAQ
They become external-facing SharePoint sites or a Power Pages portal, depending on how much control you want over what a client sees. We map every active client and the folders they can reach first, then rebuild that access with guest accounts or portal roles so each client lands on their own documents and nothing else.
They stop when ShareFile does, so they get their own workstream rather than a footnote. Before cutover we register every live link, who is on the other end, and any expiry or password rule attached to it, then replace each one with a SharePoint file-request link or a portal intake form.
The intent survives; the mechanism changes. Folder templates become SharePoint site templates, so a new matter, engagement or case provisions identically every time. Custom folder access permissions are rebuilt as inherited library permissions granted to Entra groups, instead of the per-folder exceptions nobody can audit a year later.
They are rebuilt with Microsoft Purview retention policies and labels, which is where retention belongs once files live in Microsoft 365. During inventory we write down what your policy actually requires per record type, confirm it with whoever owns compliance, then configure and test it before content moves.
Microsoft 365 includes an eSignature capability for PDFs stored in SharePoint, and Power Automate connects to Adobe Acrobat Sign and other providers where you need more. We look at what you genuinely send for signature and in what volume, then pick and configure the route during scoping rather than assuming a swap.
For part of the project, yes, which is why we plan around your renewal date. ShareFile stays live through the waves so no client is stranded mid-engagement, then goes read-only for an agreed reference window. The written scope states the point at which you can safely stop renewing.
Book a free consultation
Tell us what you’re trying to fix — a report, an approval process, an intranet, a Copilot rollout. We scope it as a fixed-fee project, you approve, and a senior engineer delivers in 2–4 weeks.
The fastest way to reach us is the form — tell us the task and we’ll reply within one business day.