Cloud, SaaS and Shared Files

Lesson 2 handled the front door, the sign-in. This lesson is about the rooms behind it. Once a person is signed in to your online accounts, three things decide whether a mistake stays small: how widely files can be shared, which outside apps are connected, and whether you can get your data back if something goes wrong.

What cloud and SaaS mean for a small business

The cloud is a plain idea with a fancy name. Your data and programs run on a provider's computers, in the provider's buildings, and you reach them over the internet. SaaS, short for software as a service, is the form you meet most often: software you rent by the month and open in a browser or an app. Email, online file storage, accounting, payroll, scheduling, a customer relationship manager (a CRM, which is a customer list with notes and history) and a point-of-sale (POS) system for taking payments are all usually SaaS.

The upside is real. The provider patches the servers, keeps the power on and runs backups of its own systems, and you do not buy or maintain a server closet. The catch is that the old way of thinking, "the computer is in my office, so I control it," no longer fits. You control the account. The provider controls the machine. Mistakes now happen in settings, in sharing links and in who was given access, and most of those mistakes are quiet. Nothing crashes. Someone just sees a file they should not.

Shared responsibility: who protects what

Every major provider describes a shared responsibility model. Microsoft puts it this way on its documentation site: for all cloud deployment types, you own your data and identities. It lists what stays with the customer in every case: your data, the devices that connect, the user accounts, and access management such as multi-factor authentication. For SaaS, Microsoft says it manages the network security, the operating system and the physical layers, while customers own their data, configurations, identities and users, and share responsibility for client devices and applications. Microsoft adds that it can offer some device management tools, but you remain responsible for protecting your own endpoints (the laptops and phones people use to reach the service).

Read that as a dividing line. The provider's side is the steel and concrete. Your side is every choice a person with an admin login can make.

The common failure

Owners often assume "it's in the cloud, so it's backed up and protected." Half of that is true. The provider will keep its service running. It will not stop your own employee from sharing a client folder with the whole internet, from approving a bad app, or from deleting a library. The Microsoft Services Agreement says as much in its service availability section: it recommends that you regularly back up the content and data you store on the services. More on that below.

Microsoft 365 and Google Workspace: the settings that matter

These two suites hold the email, calendar, documents and file storage of most small offices. Menu names move around, so use the vendor pages in the Research angle for exact clicks. The decisions underneath stay the same. Make them once, write them down, and recheck every quarter.

1. Sign-in first

Everything in lesson 2 applies: named accounts, two-step sign-in on, a separate admin account, only two admins. If you have not done that, do it before anything below. A perfect sharing policy does nothing for an account the attacker can walk into.

2. External sharing and link sharing

External sharing means giving files to people outside your company. It is a normal business need. The risk is a setting that makes it too easy, or that lets one careless click expose a whole folder.

• Microsoft 365 (SharePoint and OneDrive). In the SharePoint admin center, under Policies and then Sharing, you choose one of four levels. Anyone: links work with no sign-in at all. New and existing guests: outsiders must sign in with a work or school account, a Microsoft account, or a verification code. Existing guests: only outsiders already in your directory. Only people in your organization: external sharing off. For Anyone links you can require them to expire after a number of days you set, and limit them to view only. Microsoft's external sharing overview adds that external sharing is on by default for the whole environment, that you set it at the organization level and then at the site level, and that when the two disagree the more restrictive setting wins. Microsoft even suggests turning external sharing off globally before people start using sites, until you know how you want to use it.
• Google Workspace (Drive and Docs). In the Admin console you set sharing by organizational unit or by group. Google says the usual way to let only some people share outside is to turn external sharing off for the top unit and on for the specific group. You can warn users before they share outside the company, block link sharing, or turn on an indicator that marks files owned by or shared with someone outside. A separate visitor-sharing option lets people share with someone who has no Google account, and it can be limited to trusted domains.

A sensible default for an office of 5 to 50: sharing with named outside people who must sign in or verify, Anyone links off or short-lived and view only, and a separate, deliberate setup for the one or two folders that truly need open links, such as a public price list.

3. Guest access

A guest is a named outsider you invite into your space: an accountant, a designer, a customer on a project. Guests are safer than Anyone links because they sign in and you can see them. They are also easy to forget. A guest invited for a 2024 project can still be in the directory in 2026 with access to a folder that now holds something different.

• Share to a specific folder or project, not the whole drive.
• Give the lowest permission that works. View, not edit. Edit, not owner.
• Put guest review on the quarterly access check from lesson 2. List guests, ask who invited them, remove the ones nobody can explain.
• When a project ends, remove the guest the same week.

4. Third-party app connections

Many websites offer "Sign in with Microsoft" or "Connect to Google." When someone clicks Allow, they hand that app a permission to read or change data in their account. This is app consent, built on a standard called OAuth, and it works without giving the app the password. That is why two-step sign-in does not stop it. The user is signed in, approves, and the stranger's app now has a standing key to the mailbox or files. Criminals use this on purpose with fake apps that look like document viewers.

• Microsoft 365. Microsoft's user consent options are: do not allow users to consent, allow consent only for apps from verified publishers and only for permissions you classify as low impact, or allow users to consent to any permission that does not need admin approval, for any app. Microsoft says that by default all users can consent to apps for permissions that do not require administrator consent, and it recommends allowing user consent only for applications published by a verified publisher. Pair that with the admin consent workflow, which lets a user request a review instead of hitting a wall. Changes affect future consent only, so also review the existing list of connected apps and remove any you do not recognize.
• Google Workspace. In the Admin console, under Security, then Access and data control, then API controls, you manage app access. Apps can be set to Trusted, Limited, Specific Google data, or Blocked. Apps you have not configured fall under a third-party sign-in rule, and Google's default is to allow any third-party app. The other two choices are to allow only apps that request basic sign-in information, or to allow no third-party apps until you configure them. Users can request access, and an admin approves or dismisses from a pending list.

For a small office, the tighter choice costs a few minutes a month of approving real requests and removes a whole category of takeover. Do it.

5. Use the built-in scorecard

Microsoft offers Secure Score, found in the Microsoft Defender portal. It gives your tenant a number based on settings and behaviors, with recommended actions worth up to 10 points each. Microsoft itself says the score is not an absolute measure of how likely you are to be breached and is no guarantee. Treat it as a to-do list, not a grade. Google Workspace has a comparable security health view in its Admin console. Work through the items that match this lesson: sign-in, sharing, app consent and external forwarding.

Your other online services

Beyond the big suite, a typical small business also rents accounting, payroll, a CRM, a booking or ordering system, a POS and sometimes an industry-specific program. The sign-in and sharing questions repeat in each one.

Lesson 9 covers payment cards and customer records in depth. For this lesson the rule is: every online service that holds money, identity or customer data gets named logins, two-step sign-in, roles, and a name on your inventory.

Keep a list of your services

You cannot protect what you forgot you bought. Write down every online service the business uses: what it is, what data it holds, who is the owner of the account, who has admin rights, how it is paid for, whether two-step sign-in is on, and where the contract and recovery codes are. A spreadsheet in a restricted folder works. This list also answers an insurer's application and, if something goes wrong, tells you who to call in the first hour (lesson 10).

Vendor risk: ask before you store data there

A vendor is anyone who touches your data or systems: the payroll service, the software company, the outside IT provider, the cloud backup company. Vendor risk means that if they get breached or fail, you suffer too. The FTC and NIST both treat service providers and supply chains as part of small business security. You cannot audit a large provider, and you do not need to. You can ask a short list of questions and read what they publish.

Put the answers in your service list. If a vendor cannot answer the first, fifth and sixth question in plain language, think twice about giving it payroll or customer records.

Your outside IT provider is a vendor too

A provider that manages your accounts has the keys to the building. Keep the business's own admin login (lesson 2), ask for a named account for each technician, ask the provider to turn on two-step sign-in on its own tools, and record when they were last given or lost access. If they handle your backups, ask to see a restore test, not a promise.

Back up your cloud data

This is the surprise for many owners. "Is my Microsoft 365 or Google data backed up?" The honest answer: the provider protects its service, and gives you recycle bins and limited recovery windows. It does not promise to hold your history forever, and its agreement tells you to keep your own backup.

Here is what the vendors publish. In SharePoint, deleted items are kept in recycle bins for 93 days from the time of deletion, and Microsoft keeps backups of site content for 14 more days beyond that for a full-site restore through Microsoft Support. A deleted OneDrive of a departed employee goes to a recycle bin for 93 days after a retention period, and restoring it takes PowerShell. In Google Drive, files in the trash are permanently deleted after 30 days, and an admin can recover a user's items within 25 days after the user empties the trash. Microsoft also sells an add-on called Microsoft 365 Backup, described as offering longer protection and faster recovery from events like ransomware or a mass overwrite or deletion.

Those windows cover the careless deletion you notice next week. They do not cover the deletion you notice in four months, a ransomware attack that silently encrypts synced files, or an account taken over by someone who empties everything. For those, a separate copy is the protection.

• Choose a backup service that backs up your mail, calendar, contacts and files from Microsoft 365 or Google Workspace to a place the same admin login cannot erase. Many exist at a few dollars per user per month. Confirm the current price and features yourself.
• Make sure the backup account has its own sign-in, with two-step sign-in, separate from the one it protects. A backup that the attacker's stolen admin password can also delete is not a backup.
• For smaller or cheaper setups, schedule a regular export of the most critical files to an external drive or second cloud account. Lesson 3 explains the 3-2-1 backup pattern, and the same logic applies here.
• Export your accounting, payroll and CRM data on a schedule and keep the exports in a restricted folder. Most services have a Reports or Export menu. Test that the export opens.
• Once a year, restore one real file or mailbox from the backup. A backup you have never restored is only a hope.

Have an exit plan for each critical service

Sooner or later every service ends: the vendor is bought, raises its price, has a long outage, goes out of business, or you simply outgrow it. The exit plan is a half-page note per critical service that answers five questions. How do I export everything? In what format? How long does that take? Who has the admin login? What would I use instead, and how many days would the switch take?

An owner who never asked these questions finds out at the worst moment, usually when a service shuts down with 30 days' notice. Add a line to the service list: "Exit plan: yes/no, last exported on ____." Link it to the offboarding checklist: when a person leaves, you transfer the files they own (OneDrive and Drive files belong to the account that created them) before the account is deleted.

Who does what

Questions and answers

Is the cloud safer than a server in my back room?

Usually, for the things a provider does well: power, hardware, physical security and patching. A small office rarely matches that. It is only safer if you handle your own half: sign-in, sharing and apps. A badly set cloud account is more exposed than a locked office server, because it is reachable from anywhere.

What is the difference between Microsoft 365 and Google Workspace for security?

Both offer two-step sign-in, sharing controls, app controls, audit logs and admin consoles, and both work well for a small office when configured. Pick the one your staff and clients already use, then spend your effort on settings. Switching to fix security is rarely worth it.

Do I need a backup if I use OneDrive or Google Drive?

Yes, if the data matters. Sync is not backup. Delete a file on your laptop and it disappears from the cloud copy too. Recycle bins help for weeks, not months. An independent backup covers the rest.

How often should I check sharing settings?

Set them now, then review each quarter along with admin and guest lists. Also check after any staff change or when you add a new service.

My accountant wants me to send files by email. Is the cloud better?

Often, yes. A shared folder with a named guest, a sign-in and an end date beats an attachment that sits in several inboxes forever. If the accountant prefers email, ask about their secure portal, and see lesson 5 on safe ways to send sensitive data.

What if a vendor refuses to answer security questions?

Take that as an answer. A small vendor may not have a formal report, but should be able to say whether it supports two-step sign-in, how you export your data and how it would tell you about a breach. If it cannot, weigh whether the tool is worth the risk, and keep sensitive data out of it.

Can employees keep company files in their personal cloud accounts?

Avoid it. Files in a personal account leave with the person and you cannot see who they were shared with. Set a rule that company files live in company accounts only, and give people an easy company place to put them.

Who owns the files if the owner of the account leaves?

Files in OneDrive or My Drive belong to the account that holds them, so they can vanish when the account is deleted. Use shared folders and shared drives for team work. When someone leaves, transfer their files first (Microsoft keeps a departed OneDrive for a retention period, and Google lets admins transfer ownership), and only then delete the account.

Do I have to tell customers if my cloud vendor is breached?

It depends on what data was exposed and on the rules that apply to you. Lesson 10 covers notice basics, including Idaho's breach notice law, and your insurer's breach hotline can help you sort out the first steps. Ask your vendor in writing what was involved and keep the answer.

Hard questions

"Microsoft and Google are huge. If they can't keep things safe, why would my settings matter?"

The big providers are good at the part they control, the machines. The attacks on small firms almost always come through the part the customer controls: a stolen password, an open link, an approved app. Your settings are exactly where the risk sits.

"Tightening sharing will slow my staff down and annoy clients."

A little. The fix is to make the safe path easy: a guest invite takes about a minute, and one shared folder for each outside partner removes most email back-and-forth. Close Anyone links by default and make a clear exception for the one or two folders that need them.

"A separate backup of cloud data sounds like paying twice for the same thing."

You are paying for a second, independent copy, which is the whole point. The provider's recovery tools are built for convenience and short windows. A backup is built for the day the account itself is compromised, deleted or encrypted. For a small office the price is typically a few dollars per user per month, which is cheap next to one lost quarter of client records.

"We trust our accountant and our IT guy. Why vet them?"

Trust is a good start, and it does not replace a few facts. Do they use two-step sign-in on their own tools? Can they lose a laptop with your files on it? Do you have your own admin access? Asking is no accusation. You would want the same check from them if the roles were reversed.

"We're too small to be a target. Isn't this overkill?"

Attackers rarely pick a target by size. Automated tools probe thousands of accounts and open links at once, and small firms are attractive because they hold money and records with fewer defenses. The steps here are mostly settings and one backup subscription, and they take hours, not weeks.