Local review copy — not for publishing. Pending items remain; see the project review note.

Pinecover Discuss your agency

Microsoft 365 for independent insurance agencies

Who can reach a client's file, and what happens when they leave

Pinecover configures Microsoft 365 for independent insurance agencies, brokerages and MGAs: client and policy files organised in SharePoint, producer and staff access locked down in Entra ID with same-day offboarding, applicant and policyholder data labelled and retained correctly in Microsoft Purview, and renewals tracked automatically — so a departing producer doesn't walk out with standing access to the book.

Configuration and documentation for your team to operate. Pinecover is not an insurance agency, broker, carrier or MGA — it does not sell insurance, quote or bind coverage, adjust claims, or give legal, tax or compliance advice.

What happens to access when a producer leaves A producer reaches their last day. An account-and-access review checks Entra ID, mailbox, SharePoint and CRM or agency-management-system logins. The result is either access closed the same day, or, without that review, the account staying open with no fixed end date. Producer last day Offboarding ACCOUNT REVIEW Entra ID disabled Mailbox access SharePoint access CRM / AMS login → one outcome Closed within hours, not weeks later Open e.g. no offboarding step at all
  1. Producer last day
  2. Offboarding
  3. Account review
    • Entra ID disabled
    • Mailbox access
    • SharePoint access
    • CRM / AMS login
    → one outcome
  4. Closed within hours, not weeks later
    Open e.g. no offboarding step at all
Simplified. Exactly which systems get checked depends on which ones your agency uses.

01 · Services

Four pieces of agency configuration

Each produces configuration you can see in your Microsoft 365 admin centre and a document explaining why it's set that way. Most agencies start with file structure or offboarding.

S-01

Client & policy file structure

A SharePoint library structure any producer or CSR can navigate without asking a colleague where something lives.

  • Library structure by line of business or book segment
  • A standard folder and naming taxonomy for applications, policies, endorsements and claims correspondence
  • External sharing controls for carriers, wholesalers and MGAs — expiring links, no open "anyone" links
  • Retention and disposition aligned to your own E&O and state record-keeping schedule

Licence dependency: none beyond SharePoint, included in most Microsoft 365 business and enterprise plans.

S-02

Identity & access for agency staff

MFA and access rules for every producer, CSR and admin account, plus a same-day offboarding step for people who leave.

  • Multi-factor authentication for every producer, CSR and admin account
  • Conditional Access: block legacy authentication, require MFA or a compliant device
  • Separate admin accounts; no standing Global Administrator for day-to-day staff
  • A same-day offboarding checklist for departing producers

Licence dependency: Conditional Access needs Entra ID P1 or a plan that includes it.

S-03

Sensitive-data classification & retention

Sensitivity labels and retention for Social Security numbers, dates of birth, bank details and health information on life and health files.

  • Sensitivity labels for documents containing SSNs, dates of birth and bank or payment details
  • DLP policies that warn or block unlabelled sharing of this data outside the agency
  • Retention labels and policies built from your own record-retention schedule
  • A short staff guide for applying labels correctly

Licence dependency: sensitivity labels, DLP and retention need Microsoft 365 E5 or a compliance add-on — verify against your current licence.

S-04

Renewal workflow & book-of-business reporting

Automatic renewal reminders and a dashboard of what's coming due, built around your existing agency management system.

  • Automated renewal-reminder flows at agreed intervals before expiration
  • Stage-based notifications mapped to your own process in SharePoint or Teams
  • A Power BI dashboard of renewals due, retention rate and book composition by line

Configures Microsoft 365 around your agency management system; doesn't replace it or migrate its data. Power BI Pro is needed for report editors.

02 · Offboarding

Access after a producer's last day

The same departure, over a two-week window. Without a fixed offboarding step, access tends to linger until someone notices. With one, it ends the day it should.

Illustrative two weeks: access with and without a fixed offboarding step Without a fixed offboarding step, the account stays active for most of the two weeks shown. With Pinecover's configuration, access ends on the first day. No fixed step account stays open Configured closed same day Day 02468101214
Illustrative. Exact timing depends on your offboarding checklist and which systems a producer had access to.

Why it matters

  • A former producer who can still reach client files is a book-of-business and E&O risk, not just an IT loose end.
  • The same-day step covers Entra ID, mailbox, SharePoint and your agency management system login in one pass.
  • Accounts nobody reviews for months show up the same way in any access audit.

Some shared or service logins can't be disabled the same way as a personal account. The configuration notes which ones, and what to do instead.

03 · Data protection

Sensitive applicant and policyholder data

Applications and claims correspondence routinely carry SSNs, dates of birth, bank details and, on life and health files, medical information. The configuration treats that as the default, not an exception.

PD-1

Labelled at creation

Sensitivity labels applied as applications and policy documents are created or uploaded, not added later as an afterthought.

PD-2

Protected when shared

DLP rules warn or block an unlabelled file with an SSN or bank detail from leaving the tenant.

PD-3

Retention follows your schedule

Retention labels and policies built from your agency's own record-keeping schedule, not a Microsoft default.

PD-4

Reviewed, not one-time

A periodic check that labels and DLP rules still match how the agency actually works.

You set the retention periods and decide what counts as sensitive for your lines of business; Pinecover configures Purview to carry that out.

Free tool · Nothing you enter leaves your browser

Setup Priority Finder

Answer five short questions about how your agency handles offboarding, access, files and renewals today, and get a ranked list of which piece of configuration to start with.

Open the Priority Finder

05 · About

About Pinecover

Pinecover configures Microsoft 365 for independent insurance agencies, brokerages and MGAs that already licence it but have never connected file structure, access control, data protection and renewal tracking into one configuration. The work is configuration and a short handover guide for your agency principal, operations manager or IT contact — not a managed service, and not an insurance business of any kind.

Works with
Independent insurance agencies, brokerages and MGAs
Focus
Microsoft Entra ID, SharePoint, Microsoft Purview, Power Automate, Power BI
Doesn't offer
Insurance sales, quoting or binding coverage, claims adjustment, legal, tax or compliance advice
Doesn't promise
Prevention of E&O claims or compliance with any specific state's insurance regulations
Microsoft
Independent; not affiliated with or endorsed by Microsoft

06 · Contact

Discuss your agency

Tell us roughly how many producers and staff you have, and which of the four areas you'd like to start with.

Before you write

Don't include policy numbers, Social Security numbers, dates of birth, bank or payment details, or claims details.

Not for emergencies. This isn't a channel for an active E&O claim or a data breach in progress — contact your carrier, broker or legal counsel directly for that.

Email us directly

hello@pinecover.com placeholder

Enquiry

Fields marked are required.

Describe your agency in general terms. No policy numbers, SSNs or claims details. Up to 3,000 characters.

0 / 3,000

We use your details only to reply. See the privacy policy.