We rebuilt how ITMedic makes its own NDAs. One form goes in. A signed, sealed agreement comes out, filed and kept on schedule, without leaving Microsoft 365. The same tenant can hold the work you build with invited guests to that promise. Now we set it up for agencies and the partners who work beside them.
1 · PrepareThe other party types its own legal details. The agreement builds itself.
2 · FileA flow files the Word NDA and the issues list, and tells Teams.
3 · SignEveryone signs in Microsoft 365. The PDF is sealed.
4 · ExecuteThe signed copy moves, and each signer can view their own.
5 · KeepA retention label keeps it on your schedule, then disposes of it.
Why we rebuilt it
An NDA is often the first document a partnership produces, and the least looked after.
How NDAs usually go
A Word file emailed back and forth, each copy a little different.
A separate signing service with its own accounts and its own copy.
The signed PDF in somebody’s inbox or Downloads folder.
Nobody sure when it ends, or when it may be destroyed.
Nobody asks whether the work touches patient or criminal justice information until it already has.
How ours go now
The other party enters its own legal name, entity, address and signer through a link made for it. Nobody retypes a company name.
The agreement builds itself from one master form, with an issues list for counsel beside it.
Signatures are collected inside Microsoft 365.
The sealed PDF files itself. Each outside signer can view their own copy, and nothing else.
A retention label keeps it for the period set, then disposes of it.
How it runs
Two systems meet at two points. The intake form prepares the agreement; your Microsoft 365 tenant does the filing, the signing and the keeping. These are the diagrams we work from, with our own names taken out.
The form and Microsoft 365 meet at two points, drawn in orange: the form sends each new NDA to the first flow’s secret web address, and the flows report back with a shared key. Everything to do with signing, filing and keeping happens inside your tenant, under your identity and your policies.
SCROLL SIDEWAYS TO SEE THE WHOLE MAP
Read top to bottom. Orange arrows cross between the form and Microsoft 365; dashed arrows are replies and alerts. Only steps 10 and 11 need a person inside Microsoft 365. Everything after the last signature runs on its own.
SCROLL SIDEWAYS TO SEE ALL SEVEN LANES
Read the seventeen steps
1 · Prepare · the intake form
1Your signer signs in with a named account and starts an NDA.
2They give the Purpose (AI can help word it), answer the screening questions, choose the periods and add each other party, entered or invited. The form keeps the record and makes one signed link per invited party.
3Each invitation goes out from your own mailbox.
4The other party opens its link and gives its legal name, entity type, address and signer. You get an alert.
5With every party complete, you press Generate. The form builds the branded Word NDA and the issues list for counsel.
2 · File · flow 1
6The form sends both files to the first flow.
7The flow makes a folder for the counterparty in Drafts, files both documents and fills in their columns.
8It posts a card to the Teams review channel: ready for signature, or on hold when regulated information was flagged.
9It tells the form the NDA is filed, with the links.
3 · Sign · Microsoft eSignature
10You read the issues list, open the NDA in Word, place a signature and a date field for each signer, and send the request.
11Each signer gets Microsoft’s email. Outside signers sign in as guests in your tenant, with their own work account or an emailed code, then sign a PDF copy.
12When the last signer finishes, Microsoft seals the PDF with an audit trail and its certificate, and files it beside the Word document.
4 · Execute · flow 2
13The second flow sees the signed PDF and asks the form for the dates, the signers and the email to send.
14It moves the PDF to Executed and fills in its columns.
15It gives each outside signer view-only access to that one file, and emails each of them the PDF and a link that keeps working.
16It marks the drafts executed, posts an “NDA executed” card, and tells the form.
5 · Keep · Purview
17The retention label keeps the signed PDF for the period your records schedule sets, counted from signing, then disposes of it.
Rules built in
The rules live in the form and the tenant, not in someone’s memory. Every NDA gets them, whoever starts it and however busy the week is.
Before draftingScreening comes first
The form asks whether the work could involve patient health information, criminal justice information, classified, controlled or export-controlled information, student records, personal data, or payment card data and government ID numbers. A yes puts the NDA on hold, and the issues list names what that information needs instead, such as a business associate agreement or the CJIS Security Addendum.
One master formYour counsel reviews it once
Every NDA is built from the same master text and records which version of the form it came from. Your attorney reviews the form, not every copy, and each NDA arrives with an issues list that points counsel at what is different this time.
Public agenciesPublic records notice
When a party is a public agency, the agreement adds a public records clause: notice before release and, where the law allows, a hold of ten business days so the owner of the information can ask a court to stop it. For a Washington agency it cites the Public Records Act, chapter 42.56 RCW.
AI, in writingNo training on your information
Either side may run the other’s confidential information through AI tools only under business terms that forbid the provider from training on it. Consumer tools are out, and so is using it to train a model.
IncidentsSeventy-two hours
A confirmed security incident involving the other party’s information must be reported to them within 72 hours, with what is known and what is being done about it.
SigningSigned where your identities live
Microsoft eSignature collects the signatures inside your tenant. Outside signers prove who they are with their own work account or a one-time code sent to their email, and the finished PDF carries an audit trail and Microsoft’s certificate seal.
Least accessOne file, view only
After signing, each outside signer can open their own signed agreement and nothing else: not the folder, not the library, not the site.
RecordsKept, then disposed of
A Purview retention label keeps every executed agreement for the period your records schedule sets, counted from signing. Ours is six years. Then it disposes of it, because keeping records past their time is a risk too.
VisibilityEvery stage, on the record
Teams posts a card when an NDA is filed, held or executed, and each record carries its dates. Nobody has to ask where an agreement stands.
What an NDA cannot do. An NDA does not satisfy HIPAA or the CJIS Security Policy, and it does not authorize anyone to receive patient or criminal justice information. That is why ours goes on hold and says which agreement is missing.
Beyond the NDA: the work you build together
What an NDA protects is rarely the NDA itself. It is the plans, drafts, data and designs you build with the person who signed it. When that person works inside your Microsoft 365 as an invited guest, the tenant that collected the signature can hold the work to the same promise.
The NDA says what a guest may do with your work. Your tenant can back it up.
Signed before invitedWork is shared after the NDA is executed. The guest signs in with their own identity as an Entra B2B guest, so you never hold their password, and you can see and remove them at any time.
Terms at the doorEntra terms of use can require a guest to accept your terms before they open anything, and Conditional Access can require multifactor sign-in.
Labels that travel with the fileSensitivity labels mark shared work as confidential. With encryption, the permissions go with the file even after it is downloaded, and the label can end access on a set date, such as the close of a disclosure period.
Rules on the way outData loss prevention can warn or block when labeled work is about to be shared in a way your rules forbid.
Access that endsGuest access can be given an end date, and access reviews ask an owner on a schedule whether each guest still needs to be there. Guests nobody vouches for can be removed.
Kept and findableRetention labels keep co-created work as long as your schedule requires. When a records request or a dispute arrives, audit search and eDiscovery can show who had what, and when, as far back as your audit log goes.
What it takes. Several of these controls need Entra ID P1 or P2 (Microsoft 365 E5 includes P2), and access reviews may need Entra ID Governance. Guests are billed as monthly active users beyond a free tier, and Microsoft eSignature is billed per request through Microsoft’s pay-as-you-go, in its public cloud; both bill to a linked Azure subscription. The flows need a Power Automate premium license. Before we recommend anything, we check what your agency already owns and which Microsoft cloud it is on.
What we set up for you
We built this for ITMedic’s own agreements first. For your agency we build the same pattern in your Microsoft 365, under your name, your signer and your attorney’s terms. The intake form runs in your own Microsoft Azure, behind your own sign-in.
The intake form and the master NDA, with your legal name, your signer and the terms your counsel approves.
The SharePoint agreements site: drafts and executed libraries, one folder per counterparty, the columns that make them searchable.
The Power Automate flows and the Teams review channel.
Microsoft eSignature, turned on for that site, and the guest settings it needs.
The retention label, matched to your records schedule.
Guest controls for shared work: labels, terms of use, Conditional Access and access reviews, to the level your licenses allow.
A runbook your staff can follow, and a test run with you before the first real agreement.
For fire departments, EMS and public safety agencies, and for the vendors, consultants and neighboring agencies who work with them.
Start with one agreement.
Fifteen minutes: tell us how NDAs and guest access work at your agency today, and we will tell you what your Microsoft 365 already includes for it, and what it would take to run your next agreement this way.
ITMedic · Green IT Consulting, LLC · (206) 666-3885 · tgreen@itmedic.ai
The diagrams show ITMedic’s own NDA process, with the names of our sites, flows and channels made generic. This page describes a process, not legal advice; your attorney approves the agreement your agency signs.