Dropbox ships with sensible defaults for the broadest possible audience. For a business tenancy, five of them are worth changing immediately.
1. Restrict external sharing to a default of view-only
Edit access should be a deliberate choice, not the default.
2. Turn on link expiry for external shares
Ninety days is a reasonable default. Permanent public links are how data leaks quietly.
3. Require device approval
Available on Advanced. It stops company data landing on unmanaged personal machines.
4. Set up team folder structure before inviting users
Retrofitting structure after 200 people have made their own folders is an order of magnitude more work.
5. Enable and actually review the activity log
Set a monthly reminder. Most anomalies are obvious once someone looks.