ShareFile Secure Client Document Exchange

Overview

This solution runs a two-way secure document exchange between Citrix ShareFile (client-facing) and SharePoint (internal staff workspace), with a full Dataverse audit trail and Outlook notifications.

Inbound — a client uploads a file to a ShareFile folder; the flow copies it into the matching client's SharePoint workspace, logs the exchange to Dataverse, and emails the account manager. Outbound — staff drop a file into a SharePoint "to client" library; the flow uploads it to ShareFile, creates a secure share link, emails the client, and logs the exchange.

Why it matters: ShareFile is built for secure external file exchange; SharePoint is where internal teams collaborate. Bridging the two gives clients a secure portal while staff stay in Microsoft 365, with a complete audit trail. The Citrix ShareFile connector is not available in this environment, so every ShareFile interaction uses the built-in HTTP action against the ShareFile REST API v3, with all credentials and IDs bound to flowlibs_ environment variables; SharePoint, Outlook and Dataverse remain connector-first. Both flows pass Flow Checker with 0 errors / 0 warnings.

Use Case

Professional-services and finance teams exchange sensitive documents with clients via ShareFile but collaborate internally in SharePoint. They want files moved between the two automatically, with logging and notifications, so clients get a secure portal while staff never leave Microsoft 365.

Flow Architecture

Environment Variables

Connectors & Connections

Connector	API name	Actions used
HHTTP	http	POST OAuth token GET Items/Children GET Items/Download POST Items/Upload2 POST Shares
SharePoint	shared_sharepointonline	GetOnNewFileItems GetFileContent CreateFile
Office 365 Outlook	shared_office365	SendEmailV2
Microsoft Dataverse

Customization Guide

Almost every realistic variant of this flow can be implemented by changing environment variable values. A few cases require small edits inside the flow definition — those are called out explicitly below.

Client routing

Replace the single flowlibs_DefaultClientEmail and fixed folders with a per-client lookup (e.g. a Dataverse mapping table) so each client's files route to the correct ShareFile folder and SharePoint site.

DLP / malware scan

Add a scan step before the internal copy or the outbound upload.

Expiring links

The outbound share already sets a 14-day ExpirationDate; tune MaxDownloads and RequireLogin per policy.

Native connector

If Citrix ShareFile is added to the tenant, swap the HTTP actions for the connector's trigger / DownloadFile / UploadFile / CreateShareLink actions.

Polling cadence

Adjust the inbound Recurrence (15 min) and outbound SharePoint trigger (5 min) to taste.

Key Expressions

The flow is intentionally light on Power Fx / WDL gymnastics — the heaviest expressions are the branch-name concatenation and the approval outcome check. They are listed below in the order they appear in the flow.

@{concat('https://', parameters('EnvVar_ShareFileSubdomain'), '.sf-api.com')}

grant_type=password&client_id=…&client_secret=…&username=…&password=…

@{concat('Bearer ', variables('varAccessToken'))}

flowlibs_sharefileitemid eq '@{items('For_Each_File')?['Id']}'

@first(body('Filter_Uploaded_Item'))?['Id']

@body('Create_Secure_Share')?['Uri']

Customize & download