SharePoint Role-Based Access Control for a 450 Employee Financial Institution: A Secure Board Portal and 75% Faster Search

A case study on replacing a legacy Board of Directors portal and a scattered department document setup with a governed, 8 site SharePoint intranet for banks, complete with role-based access control, DLP policies, a custom SPFx search experience, and an AI-powered knowledge chatbot. 

Executive Summary 

An international finance and advisory bank with approximately 450 employees was running its internal communication on a legacy Board of Directors portal and a set of disconnected department document stores, with no consistent governance, permissions model, or way to search across any of it. Code Creators delivered a SharePoint intranet for banks spanning 8 sites, a Home hub plus IT, Advisory, Tax, Training, Board of Directors, Employee Directory, and Custom Search, built around 64 web parts across six of the eight sites, with Employee Directory and Custom Search built as specialized applications outside the standard web part model. Role-based access control, Data Loss Prevention policies, and retention settings were configured to a least privilege model throughout. A custom SPFx search experience with metadata filtering, alongside an AI-powered knowledge chatbot for natural language queries, cut document search time from an estimated 8 minutes to about 2, a 75% reduction. The full legacy Board of Directors archive, roughly 1,100 PDFs and presentations, migrated into the new secure SharePoint board portal. The project was scoped at 360 to 430 hours across an 18 week timeline and included a 40 hour post-launch support bucket over the following 3 months. 

About the Client 

The client is an international finance and advisory bank with approximately 450 employees working across information technology, advisory services, tax, training and development, and executive governance functions supporting a Board of Directors. Like many finance institutions, the organization had accumulated a patchwork of internal systems over time: a Board of Directors portal that had aged into a legacy platform, department document stores with no consistent structure, and no single governed environment tying any of it together. 

Governance carries particular weight in banking. Board materials, advisory client documentation, and tax records all fall under regulatory and compliance expectations that a general business intranet doesn’t have to meet, which meant SharePoint role-based access control, SharePoint data loss prevention, and retention couldn’t be an afterthought bolted on after the fact. The Board of Directors portal specifically needed to be rebuilt from the ground up as a restricted, purpose-built environment, with access rules designed into its structure from day one. 

The Problem 

The organization’s Board of Directors portal had reached the point where it was more liability than asset. Built on a legacy platform, it held years of PDFs and presentations from board meetings with no modern search, no consistent metadata, and an access model nobody could fully account for. Locating a specific prior resolution or meeting package meant manually paging through folders, and the platform’s age meant it no longer aligned with the bank’s current security expectations. 

Department teams in IT, Advisory, and Tax fared little better. Each group kept its own documents, policies, and resources in whatever structure a given team had settled on years earlier, with no shared search capability across any of it. Staff estimated a typical document search, a specific tax policy, an advisory template, an IT resource, took around 8 minutes of manual folder browsing and guessing before finding what they needed, and that was assuming the document lived where they expected it to. 

Governance gaps compounded the problem. There was no consistent SharePoint role-based access control model across the organization’s content, no SharePoint data loss prevention policy protecting sensitive information from leaving the organization inappropriately, and no retention framework governing how long records needed to be kept. For a regulated finance institution, that combination represented real audit and compliance exposure. 

What We Discovered 

Before designing a single site, Code Creators ran a structured discovery phase with stakeholders across IT, Advisory, Tax, Training, and the Board of Directors to understand both what each function needed and where the organization’s governance actually stood. 

Governance and Security Assessment 

We reviewed the existing document repositories, access models, and content structures in detail. The access review found accumulated permission grants with no clear owner on several document libraries, broken inheritance in places nobody had documented, and no formal process for removing access when someone changed roles or left the organization, a real problem for a regulated institution that needs to answer who had access to what and when. 

Based on that review, we mapped a permission model built on Microsoft Entra ID security groups aligned to function, one set for IT, one for Advisory, one for Tax, and one for Training, with a separate, more restricted set of security groups for board and executive access. Within each site, SharePoint’s own Owners, Members, and Visitors groups mapped to those Entra ID security groups to control edit, contribute, and read access respectively, so a department’s Members group could contribute content while its Visitors group could only read it, and only a small, named set of people ever held Owner rights capable of changing permissions at all. 

Data Loss Prevention and retention requirements were agreed with the bank’s compliance stakeholders during this same discovery phase, well before launch. We scoped Microsoft Purview DLP policies for SharePoint and OneDrive to detect specific sensitive data types the bank defined, including financial account numbers and government identification patterns, with enforcement actions ranging from blocking external sharing of a flagged document to notifying a compliance administrator for review. Retention labels were mapped by content type against the bank’s existing document retention schedule, so board minutes, financial records, and general department content each retain on the schedule that already applied to them. 

Board content scope was separated from general intranet content at the permissions level, with the same rigor applied beyond the visual layer. We confirmed with the bank that hub permission sync would stay disabled for the Board of Directors site specifically, since hub association only shares navigation and branding, never permissions, and turning sync on would have been the wrong default for content this sensitive regardless of how convenient it might have seemed during setup. 

Site and Content Requirements by Department  

Requirements were gathered separately and independently for each function. IT needed a document library, key contacts, and an FAQ section for internal support questions. Advisory needed an organization chart, policies and procedures, and a document library for client-facing templates. Tax needed a focused document library, FAQs, and key contacts specific to tax processes. Training needed a resources library, training-specific FAQs, and a feedback and evaluation mechanism. The Board of Directors needed the most restrictive requirements of all: a secure document repository, a meeting calendar, and a discussion forum limited to board members and designated staff. 

Search and Knowledge Access Requirements  

Because staff across every department reported the same search frustration, we scoped a dedicated Custom Search site built on the Microsoft Search index, alongside a knowledge chatbot that could answer natural language questions against internal content directly, reducing how often someone needed to search manually at all. Both needed to inherit the bank’s existing permissions directly, with no separate access model of their own, so a search or a chatbot answer could never surface content the person asking wasn’t already allowed to open. 

Building a Governed SharePoint Intranet for Banks 

The objective was an intranet that felt unified to every employee while giving the Board of Directors portal specifically the restricted, auditable environment a regulated institution’s board materials require. 

We configured the SharePoint Online environment against Microsoft’s governance best practices before building a single page: SharePoint role-based access control built on Microsoft Entra ID security groups mapped to SharePoint’s Owners, Members, and Visitors roles, Microsoft Purview DLP policies for SharePoint and OneDrive scoped to the bank’s defined sensitive data types, and retention labels aligned with the organization’s existing document retention schedule, with broader Microsoft Purview capabilities such as insider risk management scoped as a future phase. The Home Site was built as the SharePoint hub, carrying 15 web parts including a dynamic menu bar, a branded banner, hub news, quick links, a world clock and weather display, upcoming events, a “who do I call for” directory, a shoutouts section, an image and video gallery, a calendar, and a discussion board, anchoring the experience every employee sees first. 

The five associated sites were each scoped to their function. IT, Advisory, and Tax each received a document library, department-specific FAQs, and key contact information, with Advisory additionally carrying an organization chart and policies and procedures section, and Training built around a resources library, training FAQs, and a feedback and evaluation mechanism, 11, 11, 9, and 10 web parts respectively. 

The Board of Directors site, deliberately the leanest of the six at 8 web parts, was built as a secure document repository with a meeting calendar and a restricted discussion forum, with hub permission sync left disabled so association with the hub delivered shared navigation and branding only, never access, and its own Entra ID security groups controlled who could reach the site at all, limited to board members and designated executive staff from the very first day it went live. The full legacy archive, roughly 1,100 PDFs and presentations, migrated into this new structure with metadata applied during the move itself, avoiding a future cleanup project entirely. 

Two further deliverables rounded out the build. An Employee Directory gave every staff member a searchable profile with contact details, organization information, and shared files. A Power Automate flow syncs core profile fields, name, title, department, and contact information, from Microsoft Entra ID into the Employee Directory on a recurring schedule, so search and filtering perform well against indexed SharePoint data while still reflecting Entra ID changes within a defined refresh window, with no manually maintained list to fall out of date.  

A custom SPFx-based Search site queries the Microsoft Search index directly through the SharePoint Search API, scoped to the sites and libraries the searching user already has access to; because Search API results are automatically security-trimmed against the querying user’s own permissions, nobody sees content they couldn’t otherwise open, including board materials for anyone outside that site’s access list. The knowledge chatbot was built using Microsoft Copilot Studio, connected to the same SharePoint content through the Microsoft Graph connector and authenticated with each user’s own Microsoft 365 sign-in, so it answers only from content that person is already permitted to see, with no separate, broader knowledge base sitting behind it. 

Challenges Overcome 

Securing the Board of Directors Portal Without Isolating It From the Rest of the Intranet

Board materials needed meaningfully tighter restrictions than any department site, but building the Board of Directors portal as a fully disconnected system would have undermined the unified intranet the project was meant to deliver. Code Creators addressed this by structuring the Board of Directors site as its own site collection associated with the shared hub, giving it the same navigation and branding consistency as every other site while keeping its permissions, document repository, and discussion forum entirely independent, with access limited from day one to board members and designated executive staff. 

Migrating a Legacy Board Archive Without Losing Metadata Along the Way 

Roughly 1,100 PDFs and presentations sat in the legacy Board of Directors portal with inconsistent or missing metadata, and a straight lift and shift would have carried that disorganization into the new environment. Code Creators addressed this by applying metadata and content classification during the migration itself, sorting documents by meeting date, document type, and relevance as each file moved, so the new Board site launched already organized, with no cleanup pass needed after go-live. 

Building SharePoint Role-Based Access Control That Would Hold Up Under Regulatory Scrutiny 

A finance institution’s document environment gets audited differently than a typical business intranet, and governance configured loosely enough to pass initial testing but not built to last would have created problems well after launch. Code Creators addressed this by treating SharePoint role-based access control, DLP policies, and retention configuration as core discovery deliverables, validated with stakeholders well before development began. 

Results & Business Impact 

The bank now runs its intranet and Board of Directors portal through a governed, 8 site SharePoint environment covering 64 web parts across the six content sites, plus the Entra ID-driven Employee Directory and the SPFx-based Custom Search experience, with SharePoint role-based access control, Microsoft Purview DLP policies for SharePoint and OneDrive, and retention settings applied consistently across every site from the start. 

Document search time dropped from an estimated 8 minutes to about 2, a 75% reduction, driven by the custom SPFx search experience and the SharePoint AI chatbot working together, one for browsing with filters and refiners, the other for getting a direct answer without searching at all. 

The day-to-day impact varied by function. Board members and executive staff now access meeting materials and prior resolutions through a secure, searchable repository, leaving behind the legacy platform they used to page through by hand, with the full 1,100-document archive already organized by meeting date and document type. IT, Advisory, and Tax teams each have a dedicated home for their policies, templates, and FAQs, cutting down on the informal question-asking that used to fill the gap when nobody could find a document on their own. 

Every employee now has a current, Entra ID synced profile in the Employee Directory, replacing what used to be an outdated org chart, and governance staff can point to a documented, least privilege access model that replaced an access history nobody could fully reconstruct. 

Lessons Learned 

A few things from this project are worth carrying into any regulated intranet build: 

Governance has to be a discovery deliverable

Role-based access control, DLP, and retention settings are far easier to get right when they’re scoped and validated with stakeholders before a single site gets built. Retrofitting governance onto finished sites tends to mean choosing between reworking what’s already built or shipping with gaps. 

A restricted portal still benefits from a shared navigation shell

The Board of Directors site needed real isolation at the permissions layer but giving it the same hub-associated navigation and branding as every other site meant it never felt like a bolted-on system to the executives who use it daily. 

A SharePoint AI Chatbot and Search Solve Two Different Problems

The custom search experience serves people who know roughly what they’re looking for and want to filter down to it. The SharePoint AI chatbot serves people who have a question and want an answer without knowing which document holds it. Building both gave employees two different paths to the same underlying content, one for browsing and one for asking. 

Client Testimonial 

“Our board portal was something people tolerated more than trusted. Now board members pull up a resolution from three years ago in about the same time it used to take to find one from last month. What surprised me most was the chatbot. Half our IT questions used to come to me directly, and now people just ask the intranet first.” 

Director of Operations