How to Give Subconsultants Access to One Project Folder With Zero Trust

A structural engineer, an MEP consultant and a landscape architect may all need the same project's drawings for six months. None of them needs your other projects, your accounting share or your proposal archive. Zero trust keeps subconsultant access to exactly one project folder, verified at every connection, for as long as the project runs.

Why do subconsultants end up with access to more than one project?

Most over-access comes from shortcuts: a shared VPN login handed to an outside firm, a mapped drive to the whole projects share, or a guest account no one removes when the job closes. Each one gives a subconsultant your network or your entire file structure when they needed a single folder. If one of those firms has an account compromised, the attacker inherits whatever the shortcut opened.

A VPN connects the user to the network, and from there file permissions are the only barrier. If those permissions were set years ago at the share level, an outside user can often browse far more than intended.

What does zero trust change for outside users?

Zero trust removes the assumption that being connected means being trusted. NIST SP 800-207 defines zero trust as granting no implicit trust to users or assets based only on their network location, and requires authentication and authorization before each session to a resource. In 2024, CISA, the FBI and partner agencies urged organizations to move from traditional VPNs toward zero trust approaches.

For a subconsultant, that means three checks before every connection: who they are, whether their sign-in meets your requirements, and whether this specific project resource has been granted to them.

Where does the project folder live?

Where the folder lives decides the method: SharePoint and Teams folders are controlled with guest access and Conditional Access, while folders on an on-premises file server need a zero trust network access (ZTNA) service plus folder permissions. Many AEC firms have both, and the two patterns below work side by side.

How do you limit subconsultant access to one project in SharePoint?

Give each project, or each project's external collaboration area, its own site or channel, and invite the subconsultant as a guest to that site only. Their access then follows the site, and nothing else in your tenant is shared with them. The guest accounts themselves also need an owner and an end date, covered in how to manage contractor and subconsultant identities.

• Turn on guest access expiration so guest access ends after a set number of days unless a site owner extends it.
• Use an Entra entitlement management access package for each project, with an expiration date and a project manager as approver.
• Require multifactor authentication for guests in Conditional Access. If the subconsultant's firm also uses Microsoft 365, cross-tenant access settings let you accept their MFA so they do not register twice.
• Schedule access reviews for guest users so a project manager confirms each outside user still needs access.

How do you limit a subconsultant to one folder on a file server?

Publish the file server through a zero trust network access service as its own application, assign only that project's group to it, and set folder permissions so the group can open its project folder and nothing else. Both layers are needed. The ZTNA service decides who can reach the server. Folder permissions decide what they can open once there.

In Microsoft Entra Private Access, for example, a per-app application is defined by destination, port and protocol, users or groups are assigned directly to the app, and Conditional Access applies to that app alone. Two practical points:

• ZTNA segments by server and port. It cannot see folders, so a subconsultant granted the file server can see any share their permissions allow. A dedicated share per project, or a project group applied only to that folder, closes the gap.
• Check how your ZTNA provider handles external users. Many require an account in your directory and a client on the device. Some firms issue subconsultants a firm account for that reason, tied to the project group and an end date.

ZTNA controls access. It does not make large Revit or CAD files open faster over a slow connection, so test performance with the subconsultant before the project starts. For the wider move off a shared VPN, see how to replace your VPN with zero trust network access.

What changes on defense projects?

If a subconsultant needs Controlled Unclassified Information, the controls above become documented requirements. NIST SP 800-171 Rev. 2 requires limiting system access to authorized users (3.1.1), least privilege (3.1.5), protecting CUI during and after personnel actions such as terminations and transfers (3.9.2), and monitoring, encrypting and routing remote access through managed control points (3.1.12 to 3.1.14). A per-project, expiring, logged grant is evidence an assessor can follow. Confirm with your prime contractor and counsel which CUI the subconsultant may receive before you share it.

What should an AEC firm do this quarter?

1. List every outside firm with access today and the projects each one is on.
2. Remove shared VPN logins and any guest whose project has closed.
3. Pick the pattern for each location: SharePoint site per project, or ZTNA app plus project folder permissions.
4. Turn on guest expiration and MFA for guests.
5. Create a project access request that names the project manager as approver and sets an end date.
6. Run the first access review at the next project milestone.

How s90 helps

s90 designs and runs Zero Trust Network Access for AEC firms, including per-project access for subconsultants that ends when the project does. We set up guest controls in Microsoft 365, publish file servers by project and keep the access log your clients and assessors may ask for. If outside firms are on your network today, we are glad to map out what one-folder access would look like for your next project.