Why your approach to external sharing in Microsoft 365 is wrong

Oct 22, 2020Exchange Online, Microsoft Teams, Office 365, SharePoint Onlinecompliance, Data Loss Prevention, external sharing, firewall, governance, information protection, permission, protection, security, sensitivity labels

Yes, this is another post where I go on an unhinged rant about something I’ve been seeing for too long. There are so many things I see out there that I think this is going to become a series.

If you work in an organisation that allows external sharing, you can stop reading here (although stay tuned for future posts as I’m sure I’ll find something wrong with your approach to something else).

I help a lot of organisations built out Microsoft 365 governance frameworks. No, not Teams governance. Not SharePoint governance. Whole of Microsoft 365 governance. We look under every rock and find the things that people don’t know about or don’t want to see.

Every so often I come across an organisation that doesn’t want to allow their staff to share externally. When pressed as to why the response will be something around their legislative or privacy requirements, or because they are in industry X they need to comply with Y. More often than not I’ve previously dealt with an identical organisation in the same field (i.e. government, financial services, education, etc.) who has no issue with external sharing – so why can they do it but you can’t?

Wrong approach: we’ve disabled external sharing from SharePoint and OneDrive

The issue I see with this view is that people often talk about external sharing in Microsoft 365 as if it only applies to SharePoint Online and OneDrive.

WRONG.

External sharing exists in a number of workloads where data can be captured and stored such as: Sway, Forms, Outlook calendar, Power BI, Bookings. While the data stored in these is not the same as a file share, there can still be small snippets of privacy or information that is enough to cause an issue – because all it takes is just one little thread to be pulled…

Wrong approach: we’ve disabled external sharing from every service in Microsoft 365

Well, even with sharing from SharePoint and OneDrive disabled, you can use Power Automate so that every time a file is deposited in location X a workflow takes a copy and puts it in an external service.

Don’t believe me? Have a look at this template, provided by Microsoft themselves:

Figure 1: Power Automate template provided by Microsoft

Wrong approach: we’ll just bury our head in the sand

Easy you say – you’ll just turn those app, services and features off; problem solved.

Well, aren’t you just a party pooper. What a dull, windowless existence your staff must lead, being prevented from sharing content externally.

Here’s the thing: if you stop people from doing something they really want to do – they’ll find a way around it.

Turn off external file sharing? They’ll use Dropbox, Box, Google Drive, etc.

Disable Forms? They’ll use SurveyMonkey.

Disable Bookings? They’ll use Calendly.

Anything you disable in Microsoft 365 has an equal (and sometimes better) equivalent service. And I’m fairly sure when they log into that external service it’s with an account that isn’t connected to your Azure Active Directory – so now you have no knowledge, no visibility, and no control over it. And if they do log in using their Azure AD account… well, that’s equally as concerning because now that third-party service has access to your directory, staff details, perhaps the users mailbox and OneDrive, every SharePoint site they use, etc.

Wrong approach: we’ll block external services at the firewall

Really? Every single service out there?

Also, who sits behind a firewall these days, especially in this COVID era of working from home?

And anyway, they can always just send the files as an email attachment, copy them onto a USB stick, Bluetooth transfer them to another device, beam them to another computer across WiFi, etc.

Wrong approach: we’ll block attachments, disable USB storage devices, and disable a bunch of other methods

At this point I need to ask – should you even be in the cloud, and especially in a multi-tenant environment? No, you shouldn’t.

You should be sitting in a dark room with multiple locks on the door, a jammed shut window, writing things on paper, storing them in a filing cabinet with lock and key, only letting people in if they know the secret handshake, and burning documents when you’ve finished with them.

I mean come on, what’s the point of even being digital and using a collaborative platform like Microsoft 365 if you’re going to do everything in your power to stop people collaborating with external people. Because not everyone exists in your bubble. There are people outside of it, people your staff need to interact with, share information with, and work together on common files.

Better approach: choose where can be shared externally

Yes, that’s right, in Microsoft 365 you can choose which site you want to be able to share externally. You can set the allowed sharing level for SharePoint and OneDrive to be all the up to anyone (which means anonymous links), and choose what level each site should be able to share to.

Figure 2: Tenant-level sharing settings

Figure 3: Site-level sharing settings

Better approach: choose who can share externally

Use group membership to define who can share externally, if you don’t want everyone in the organisation to have full access.

This can work separate to, or in conjunction with site-level sharing.

Figure 4: Group-level sharing settings

Better approach: chose what can be shared externally

Another layer that can be added, or used standalone, is to control who can access the content – regardless of sharing permissions or location.

Using sensitivity labels we can apply permissions based on content, location, group membership, domain, and others.

This allows us to have a scenario where files can be shared externally by anyone, but only people who are members of a specific group can even open those files. This works well with sharing files externally as we can enforce terms like “valid for 30 days” or “commercial in confidence” by actually expiring or withdrawing access to files.

Figure 5: Group-based access to files

This scenario is different from site permissions, because this allows us to have internally sensitive files sitting in a SharePoint site that a group of people can access but only a subset of people can access those specific files. So a user can share them, but the file can’t be opened if the person isn’t a member of the specific group.

Additionally, organisations can look to utilise Data Loss Prevention (DLP) to stop the person from sharing something that shouldn’t be shared (as it may be a legitimate accident).

Figure 6: DLP policy being applied to content shared externally with sensitive words

Better approach: review the audit log and set alerts

The audit log in Microsoft 365 captures almost everything. You open an email – it’s logged. You open a file – it’s logged.

More importantly, you share a file – it’s most definitely logged.

Because of this we can set up alerts to notify administrators or compliance officers when something is being shared that shouldn’t be.

Figure 7: Activity alert policy on external file sharing

But what about anything that’s not SharePoint or OneDrive?

Different apps and services in Microsoft 365 have different levels of controls. For Sway and Forms for example, the setting is tenant-wide.

For Power Automate it is possible to create DLP policies that block connection to external services.

For Azure AD it is possible to stop users from consenting to apps accessing their account and the organisation’s environment, and currently in preview is the ability to have an approval process.

Power BI can leverage Information Protection as well has using group-based access controls as to who can share externally.

This is where organisations need to look at the bigger picture, then the little picture, then the big picture again, and think about how they should approach things.

It’s unrealistic to expect organisations to get this right the first time, especially as technologies evolve and new levels of control are introduced.

The management of external sharing should not simply be considered by tenant, site, and group-based controls.

More so organisations should address their policy requirements, understand product capabilities, and educate their people.

Get your head out of the sand. Let your users share externally. Be smart about it. Educate them, educate yourself, and put the proper systems in place to strike a balance between user friendly and secure.

Three things Microsoft Stream needs to sort out, pronto!

Jul 27, 20183 CommentsOffice 365external sharing, Microsoft Stream, Office 365 Video, transcription, Vimeo, YouTube

Microsoft Stream is a fantastic video service built into Office 365 that delivers some absolutely amazing features. However, this blog post isn’t about blowing smoke up Stream’s tailpipe. Most of the times MVPs will sing the praises of various Microsoft products, and sometimes we need to speak up – warts and all. This is one of those posts.

Last week Microsoft announced live events in Microsoft Stream, Microsoft Teams and Yammer. This is a great thing, really, it is. Unfortunately, however a number of the clients I work with and speak to in Australia do not have nice things to say about Stream because of three main reasons which I’ll outline below. To give a bit of context, Stream became Generally Available (GA) on June 20, 2017. It is no Spring chicken.

Office 365 Video

The Office 365 Video service still exists in the platform. As a result, there are two video streaming services in the one platform, and while it has been acknowledged that there will be a migration from one platform to another; there has been nothing further.

The most recent update is from February 2018 on the Microsoft Docs site: https://docs.microsoft.com/en-us/stream/migrate-from-office-365

Other than the ambiguous 2018 Q1/Q2 (which has come and gone) there is no timeline. We are still waiting. Perhaps this is something the Stream team are keeping under their belt to announce at the Microsoft Ignite conference, so that people will cheer for it (as opposed to the current stance where customers are frustratedly knocking on doors hoping for an answer).

The original post from the Stream team about it and Office 365 Video was written almost two years ago: https://stream.microsoft.com/en-us/blog/microsoft-stream-and-office-365-video/

External sharing

When Stream was launched in preview there was a screenshot of the sharing window within the product, where “Public” was an option; indicating the ability for people to be able to share videos externally. As this was a feature many users had been wanting from Office 365 Video, it was widely hoped that this feature would come to Stream. However here we are a year later with no external sharing with either named or anonymous users.

Over on the Stream Ideas site a thread shows that the feature is planned, but there’s no timing yet, and the comment is old. The same is applicable for Office 365 Video.

The frustrating thing is that this is possible when sharing a video file from SharePoint or OneDrive, but this does not offer any of the intelligent features of Stream; it’s simple file sharing that plays in a browser.

For now, organisations who want to share videos externally and want some metrics around views as well as providing transcriptions, links, and other integrated features… well… they will have to continue using YouTube or commercial services like Vimeo.

Transcription

The transcription feature of Stream is touted as nothing short of fantastic for the discovery and search of content, because in reality it makes viewing a lot easier as people can jump straight to content based on the words they’re looking for. When it works…

In the land down under, I have not yet met a person who has found the transcription service anything close to useful. Stream became available in Australia on October 31^st, 2017 so one might think that it understood “Australian”. We speak English here, and like many English-speaking nations we have our own accent. Within the country itself there are variations of this accent; something that is not unique to Australia. Here is the first thirty seconds of transcription from a couple of recorded videos I’ve uploaded (either from Teams or Skype for Business):