If clients send onboarding documents by email, staff may need to chase missing files, rename attachments, move documents into shared folders, and work out which submission belongs to which case. A client portal can give users a clear place to submit documents while connecting each submission to the correct organization, onboarding request, and review task.
Power Pages can provide the external submission experience, while SharePoint Online may be suitable for document storage and staff collaboration. Dataverse can hold the structured records and status information that connect documents to the onboarding workflow. The right design depends on security, retention, storage, licensing, and how staff need to work with the files.
Design the document workflow before choosing storage
Start by listing each document requirement and answering:
- Is the document mandatory or optional?
- Which onboarding step or business rule requires it?
- Which file types and sizes are accepted?
- Does the document need staff approval?
- Can a client replace a rejected or outdated document?
- Who can read, download, update, or delete the file?
- How long must it be retained?
- Does the document contain sensitive or regulated information?
This inventory helps determine the required portal fields, file-handling behavior, data model, and storage controls.
A practical document submission workflow
A typical workflow could be:
- 1The client opens an onboarding case and sees the required document list.
- 2The client selects a requirement and uploads a file.
- 3The portal validates permitted file types and size limits where supported.
- 4The system records the file's association with the organization, onboarding case, and document requirement.
- 5The client sees a confirmation that the submission was received.
- 6Staff receive a review task or notification.
- 7Staff mark the document as accepted or request a replacement.
- 8If a replacement is required, the client receives clear instructions and the document status changes.
- 9The case advances only when the required documents satisfy the agreed completion rules.
The portal should distinguish between "uploaded," "under review," and "accepted." A successful upload does not necessarily mean the document meets the business requirement.
Dataverse and SharePoint: what belongs where?
A common pattern is to keep structured workflow data in Dataverse and use SharePoint for files where its document-management features suit the requirement.
This is a reference pattern, not a mandatory architecture. Validate the current supported integration options and licensing before selecting the final design.
Secure the actual file, not just the upload form
The document workflow must enforce access rules at the point where a file is retrieved. Hiding a file from a list is not sufficient if someone can still open a direct link.
Define whether external users may view only their own uploads, whether other contacts in the same organization may see shared files, and whether staff have broader review access. Confirm how those rules are enforced by the selected storage and integration design.
Test direct URLs, unauthorized downloads, replaced files, removed users, and documents linked to cases from another organization. See how to keep each client's data separate in Power Pages.
Validate and handle files responsibly
The user interface should communicate accepted file types, size limits, and upload progress. The system should handle interrupted uploads, duplicate submissions, unsupported formats, and attempts to replace files that are already approved.
Depending on the risk profile, the solution may also require malware scanning, content inspection, or additional review before a file is made available to staff. Do not assume that a file extension alone proves a file is safe.
Set retention and deletion rules with the organization. Decide how document versions are handled and how staff can identify the current accepted version. Avoid copying files into multiple locations without a clear reason, because duplicates can complicate retention and access control.
Connect documents to reminders and onboarding status
A document's state should feed the wider workflow. For example, a missing mandatory document may trigger a reminder, while a rejected document may create an action for the client and notify the assigned reviewer.
Define when reminders start, how frequently they repeat, when they stop, and how exceptions are handled. The Power Automate onboarding guide explains how to design these notifications. The progress-tracking guide explains how document states can contribute to case completion.
Questions to settle before development
- Which document types are required for each onboarding path?
- Can the same document satisfy more than one requirement?
- What are the maximum file size and accepted formats?
- Who can view a document after upload?
- Does the client need to see reviewer comments?
- What is the replacement and versioning process?
- What are the retention and deletion rules?
- Which Microsoft environment and storage configuration will own the files?
- How will upload failures and unauthorized access be tested?
Build document collection into the full portal
Document upload is one part of a wider client experience. It should connect to forms, review tasks, status tracking, and notifications rather than operating as an isolated file-transfer feature.
Read the complete client onboarding portal guide for the wider architecture, or use the client portal requirements checklist to prepare the document requirements.
