How an Aircraft Leasing Company Finally Got Its Documents, Access and Approvals in One Place

Ever spent half a morning hunting for a file that "should be in the shared drive," only to find three versions and no idea which one is current? Now picture that in a business where the document might be reviewed by a regulator, an airline customer, or an auditor.

That was the position one global aircraft lessor found itself in. Here's how the problem looked, what got built, and what changed.

Why does an aircraft lessor care so much about paperwork?

Leasing is a huge part of aviation. Around 53% of commercial aircraft worldwide are leased, according to CAPA's fleet analysis. A lessor buys aircraft and leases them to airlines across many countries. Planes move between operators and jurisdictions, and the records move with them.

The same goes for the people's side. Employee records, aviation policies and operational documents all have to be accurate, current and visible to the right people only. This client's staff included operations specialists, asset managers, legal, finance, HR and IT, spread across an Asia-Pacific head office and regional offices worldwide.

What was actually going wrong?

Nothing dramatic. It was a slow build-up, the kind that grows quietly and then suddenly becomes urgent. Years of files had piled up across shared drives, email attachments and departmental folders. Each file was fine on its own. Together they were a mess.

• Finding a document meant knowing who filed it and where.
• Nobody could be sure they had the latest version and not a copy saved on someone's laptop.
• Onboarding, audits and routine requests all took longer than they should.
• Staff kept bookmarks, remembered URLs and asked colleagues just to reach the internal tools and industry sites they used daily.

The bigger worry was access. Some documents were sensitive because they were about individual employees. Others mattered because regulators look at them closely. Permissions were being managed by hand, folder by folder, with no easy way to check they were right.

That's a real risk, not a housekeeping issue. IBM's 2026 Cost of a Data Breach report puts the global average cost of a breach at a record $4.99 million, with the US average at $11.5 million. Most of that bill comes from finding and escalating the breach and from lost business. Documents that the wrong person can open are a slow leak waiting for a bad day.

Where do you even start? With security, not screens

Most intranet projects begin with how the home page should look. Our team at Dotsquares began with a different question: who should be allowed to see what, and how do we make that rule hold up as people join and leave?

The answer was a centralised digital workplace on SharePoint Online, sitting inside the client's own Microsoft 365 tenant. That mattered to a business that regulators and lessee airlines examine regularly. Being able to show how information is controlled is worth as much as the control itself.

The build covered requirements analysis, UX design, custom development on the SharePoint Framework, document management, the permission model and workflow automation. If you're weighing a similar project, our SharePoint development services have more on how we approach it.

How does access work when nobody has to remember it?

This was the most carefully planned part of the build. Access runs on roles, across three main groups: HR, IT and Aviation Operations.

• HR can view employee documentation. Other departments can't.
• Operational and regulatory documents are open to the teams that need them and closed to everyone else.
• Permissions follow the role, not the individual, and are tied to the company's central directory through Azure Active Directory.

That last point is what keeps it working. Hand-managed permissions drift over time. Someone changes teams, someone leaves, and old access lingers. When the rules sit on roles and the directory, the model updates as the organisation does.

What does the portal look like day to day?

Simple, by design. Staff sign in and land on a home page shaped around their role. There's no training curve, which was an explicit requirement. Specialists have better things to do than learn an intranet.

Behind that front door:

• Document libraries with metadata, search and version history. Retrieving a policy or record means typing into a search box. There's always one current version and a clear trail of what changed.
• An employee directory so people can find colleagues across regions.
• A news and events area so the admin team has one reliable channel for company updates.
• A quick-access panel that gathers the internal IT applications and external aviation industry sites in one place, so no more scattered bookmarks.

It also works on tablets and phones, which counts for a lot when people are travelling between offices or sitting with airline customers.

What about approvals that depend on someone remembering to forward an email?

That's the kind of process that quietly stalls. We replaced it with defined flows in Power Automate. A document goes for review and reaches the right approver automatically. The requester can see where it is. The outcome gets recorded, and that record doubles as an audit trail without anyone building one on the side.

This choice has a timing angle too. Microsoft fully retired SharePoint 2013 workflows in Microsoft 365 on April 2, 2026, and existing workflows on that engine no longer start. If your approvals still run on the old engine, it's worth checking them now. 

What changed once it went live?

The client didn't get one dramatic moment. It got a lot of small frictions removed at once.

• Speed: Finding an employee record or policy went from search-and-ask to a few seconds in a search box. HR, which carried most of the manual filing, got capacity back for work that needs judgement.
• Access: The problem is now solved by structure rather than vigilance. Permissions follow the role, and the risk of someone seeing what they shouldn't has dropped with the admin overhead.
• Compliance: There's one authoritative copy of each policy and a visible change history. When a regulator or airline customer asks how documents are controlled, the answer can be shown, not just described.
• Approvals: Requests reach the right person, statuses are visible and nothing quietly stalls.
• Growth: Libraries, metadata and the permission model were built for a much larger document set and headcount than the client had on day one, so growth doesn't mean a rebuild.

What can other businesses take from this?

You don't have to lease aircraft for this to apply. If any of these sound familiar, the same thinking fits:

• Sensitive documents sit in folders where permissions are checked by memory.
• Staff can't tell which version of a file is current.
• Approvals depend on email forwarding.
• Your internal tools live in everyone's personal bookmarks.

Fix the access model first, then the search, then the routine processes. In that order, the rest gets much easier.

FAQs

Can a SharePoint portal really keep HR files visible to HR only?
Yes. Role-based groups tied to the company directory control who sees what, so employee records stay closed to other departments.

Does it work for staff who travel a lot?
Yes. The portal works on desktop, tablet and mobile, so staff can reach documents from any office or customer site.

Will it cope as the document library grows?
It was built for it. Library structure, metadata and search were designed for far more content than the client started with.

Does data stay inside our own environment?
Yes. The platform runs inside the client's own Microsoft 365 tenant, not a separate third-party system.

Want something like this for your business?

If your documents, permissions and approvals are held together by memory and email, we should talk. Tell the Dotsquares team what's slowing your people down, and we'll map out where to start.