Clio Operate can use SharePoint Online as its document management system, so documents live in your own SharePoint sites rather than in Clio Operate.

Before you start

• Global administrator or SharePoint administrator access to Office 365, so that you can create site collections.
• Administrator access to Clio Operate, so that you can open the admin console.
• Permission in Microsoft Entra to create an app registration and to grant admin consent. See Create an app registration for Clio Operate for the roles.
• An Office 365 account to use as the system account, licensed for SharePoint Online. An E3 licence, or another plan that includes SharePoint Online, is sufficient.
• An information architecture decision. See Plan your SharePoint information architecture below.

How Clio Operate secures the connection to Office 365

The SharePoint Online integration uses the industry standard OAuth 2.0 protocol, so Clio Operate never stores your Office 365 credentials. An administrator or an end user signs in to Microsoft, and Microsoft issues security tokens to Clio Operate. Think of these tokens as temporary passes that you can revoke at any time.

Clio Operate stores tokens in its database, encrypted with 256-bit AES.

Because each account is linked to an interactive Microsoft sign-in, your existing identity controls still apply. Accounts can have MFA enabled, and Microsoft evaluates the sign-in against your Conditional Access policies in the same way as any other sign-in. No account needs an app password, and no account needs excluding from your security baselines.

How Clio Operate acts on your users' behalf

Clio Operate uses two kinds of linked accounts for SharePoint.

• An end-user's own linked account. Clio Operate then acts as that user in SharePoint, so the documents they see are limited to their SharePoint permissions, and actions such as generating or uploading documents are recorded against them.
• The system account. A single Office 365 account linked to the integration itself. Clio Operate uses it when no user account is available.

The system account exists because not every Clio Operate user has an Office 365 account. B2B and B2C users on your tenant do not, and workflows sometimes need to create SharePoint folders or sites during matter inception, with no user in context. Give the system account the lowest privileges necessary to do that work.

Create the system account in Office 365

Create an Office 365 account for Clio Operate to use, licensed for SharePoint Online. You will grant it access to each site collection in the next section and link it to Clio Operate later.

Plan your SharePoint information architecture

Decide where documents will live before you create any sites, because moving them later is disruptive.

Clio Operate stores several kinds of documents in SharePoint:

• Inbound post and email that is not related to a specific case or matter.
• Document templates and enclosures.
• Documents for a specific instruction or enquiry.
• Documents for a specific matter or case.

For matter documents, you have two common options:

• A site per matter, with documents in a document library on that site. This is the default.
• A single document library with a folder per matter.

The steps below describe the most common arrangement, which is one site collection per year. Splitting by year keeps each site collection below SharePoint's content limits, because Clio Operate places documents according to the year the case was created. Other arrangements work too, such as a site collection per major client. Your project team can advise.

Set up site collections

Repeat these steps for the current year, and again for future years.

1. Navigate to https://admin.microsoft.com and sign in as a global administrator or a SharePoint administrator.
2. In the left pane, select Resources > Sites. You may need to select Show all before Resources appears.
3. Select Add a site.
4. Complete the form, setting the site name to the year, then select OK.

Provisioning takes a few minutes. The new site includes a default document library named Documents, which is the one Clio Operate uses. If you need a different library or structure, agree on it with your project team first.

Then give the system account access to the site:

1. Navigate to the site you created.
2. Select the settings icon, then select Site settings.
3. Select People and groups.
4. Select the [site name] Owners group.
5. Select New > Add Users.
6. Enter the name of the system account, then select Share.

The system account now owns the site and its contents.

Create the app registration

Follow Create an app registration for Clio Operate, using the values in the SharePoint Online row of the table in that article. In summary, SharePoint needs:

• A redirect URI of type Web, set to https://[your-Clio-Operate-instance]/externalServices/replyFrom.
• A client secret.
• The offline_access, Files.ReadWrite.All and Sites.ReadWrite.All delegated permissions, with admin consent.

You need three values from the registration: the Directory (tenant) ID, the Application (client) ID and the client secret.

Set up the linked service in Clio Operate

1. Sign in to Clio Operate as an administrator and open the admin console.
2. Navigate to Integrations > Manage Linked Services.
3. Select Configure on the card for the Office 365 - Sharepoint provider.
4. Under App configuration, enter the Tenant Id, App Id and Client secret.
5. Select Save and close on the ribbon.

The card displays Configuration valid. Until the configuration is valid, the service is unavailable.

Link the system account

1. On the Office 365 - Sharepoint card, select Link.
2. Sign in to Microsoft as the system account you created earlier.
3. Agree to let Clio Operate access content on your Office 365 service.

Microsoft records consent against the account that signs in, so sign in with the system account rather than yourself. After linking, the card displays the linked account address, and Link changes to Unlink.

Make SharePoint available to users

End-users can only link their own Office 365 account if the service is available to one of their teams.

1. Navigate to Integrations > Manage Linked Services.
2. Select Configure on the card for the Office 365 - Sharepoint provider.
3. Under Team availability, start typing a team name and select it to add it to the list. You can add several teams.
4. If team members must link their own accounts, select Required for that team.

An end-user sees the service only if they belong to at least one of the teams listed here. Users in those teams manage their link from My linked accounts in the account menu.

When you mark a team as Required, Clio Operate prompts team members who have not yet linked their accounts with a toast message until they do.

Users link their own accounts

Each end-user links their own account, and only they can do it, because linking requires them to sign in to Microsoft as themselves.

1. Select the account menu, then select My linked accounts.
2. Find the Office 365 - Sharepoint service. Services that are required are highlighted.
3. Select Link and sign in to Microsoft.

Users who have not linked a required service can also start from the prompt that Clio Operate displays.

Test the connection

1. Select the account menu, then select My linked accounts.
2. Find the Office 365 - Sharepoint service.
3. Select Inspect, then select Test connection.

A successful test confirms the app registration and the linked account.

Then confirm a document round trip: open a matter in Clio Operate, generate or upload a document, and verify that it appears in the expected SharePoint site.

When a linked account expires

A linked account does not last indefinitely. When one ends, Clio Operate falls back to the system account for that user, so documents continue to work, but they are no longer security-trimmed to that user, and their actions are recorded against the system account instead. If the system account link ends, document access stops.

Two things end a link. A refresh token expires after 90 days of inactivity. And an administrator resetting the account password from the Microsoft Entra admin center or the Microsoft 365 admin center removes the link, as does revoking the account's sign-in sessions. A user changing their own password does not.

For the full list, see What invalidates the tokens.

Plan for this when you rotate the system account password. Only the user can relink their own account, from My linked accounts. An administrator relinks the system account from the Office 365 - Sharepoint card.

Configure document repositories

Your project team creates the document repository configuration that specifies which SharePoint sites and libraries to use in Clio Operate. Provide them with the SharePoint site and the document libraries for each repository you need.

For background on repositories and their configuration, see Document Management Information. 

Related articles

• Create an app registration for Clio Operate
• Using O365 for Authentication
• O365 Integration: Overview