You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
Copy file name to clipboardExpand all lines: articles/active-directory/fundamentals/9-secure-access-teams-sharepoint.md
+42-45Lines changed: 42 additions & 45 deletions
Display the source diff
Display the rich diff
Original file line number
Diff line number
Diff line change
@@ -116,7 +116,7 @@ Learn more:
116
116
117
117
In the Azure AD admin center, you can use the External Sharing settings for SharePoint and OneDrive to help configure sharing policies. OneDrive restrictions can't be more permissive than SharePoint settings.
122
122
@@ -127,73 +127,70 @@ Use the guidance in this section when configuring external sharing.
127
127
***Anyone** - Not recommended. If enabled, regardless of integration status, no Azure policies are applied for this link type.
128
128
* Don't enable this functionality for governed collaboration
129
129
* Use it for restrictions on individual sites
130
-
***New and existing guests** - Recommended if integration is enabled.
131
-
* With Azure AD B2B integration enabled, new and existing guests will have an Azure AD B2B guest account that can be managed with Azure AD policies.
132
-
133
-
***Without Azure AD B2B integration** enabled, new guests will not have an Azure AD B2B account created, and they cannot be managed from Azure AD. Whether existing guests have an Azure AD B2B account depends on how the guest was created.
134
-
135
-
***Existing guests**. Recommended if you do not have integration enabled.
136
-
137
-
* With this enabled, users can only share with other users already in your directory.
138
-
139
-
***Only people in your organization**. Not recommended when you need to collaborate with external users.
140
-
141
-
* Regardless of integration status, users will only be able to share with users in your organization.
142
-
143
-
***Limit external sharing by domain**. By default SharePoint allows external access, which means that sharing is allowed with all external domains. If you want to restrict or allow specific domains just for SharePoint, you can do so here.
144
-
145
-
***Allow only users in specific security groups to share externally**. This setting restricts who can share content in SharePoint and OneDrive, while the setting in Azure AD applies to all applications. Restricting who can share can be useful if you want to require your users to take a training about sharing securely, then at completion add them to an approved sharing security group. If this setting is selected, and users do not have a way to gain access to being an “approved sharer,” they may instead find unapproved ways to share.
146
-
147
-
***Allow guests to share items they don’t own**. We recommend leaving this disabled.
148
-
149
-
***People who use a verification code must reauthenticate after this many days (default is 30)**. We recommend enabling this setting.
130
+
***New and existing guests** - Recommended, if integration is enabled
131
+
* Azure AD B2B integration enabled: new and current guests have an Azure AD B2B guest account you can manage with Azure AD policies
132
+
* Azure AD B2B integration not enabled: new guests don't have an Azure AD B2B account, and can't be managed from Azure AD
133
+
* Guests have an Azure AD B2B account, depending on how the guest was created
134
+
***Existing guests** - Recommended, if you don't have integration enabled
135
+
* With this enabled, users can share with other users in your directory
136
+
***Only people in your organization** - Not recommended with external user collaboration
137
+
* Regardless of integration status, users can share with other users in your organization
138
+
***Limit external sharing by domain** - By default, SharePoint allows external access. Sharing is allowed with external domains.
139
+
* Use this option to restrict or allow domains for SharePoint
140
+
***Allow only users in specific security groups to share externally** - Use this setting to restrict who shares content in SharePoint and OneDrive. The setting in Azure AD applies to all applications. Use the restriction to direct users to training about secure sharing. Completion is the signal to add them to a sharing security group. If this setting is selected, and users can't become an approved sharer, they might find unapproved ways to share.
141
+
***Allow guests to share items they don’t own** - Not recommended. The guidance is to disable this feature.
142
+
***People who use a verification code must reauthenticate after this many days (default is 30)** - Recommended
150
143
151
144
### Access controls
152
145
153
-
Access controls setting will affect all users in your organization. Given that you may not be able to control whether external users have compliant devices, we will not address those controls here.
154
-
155
-
***Idle session sign-out**. We recommend that you enable this control, which allows you to warn and sign-out users on unmanaged devices after a period of inactivity. You can configure the period of inactivity and the warning.
146
+
Access controls setting affect all users in your organization. Because you might not be able to control whether external users have compliant devices, the controls won't be addressed in this article.
156
147
157
-
***Network location**. Setting this control means you can allow access only form IP addresses that your organization owns. In external collaboration scenarios, set this only if all of your external partners will access resources only form within your network, or via your VPN.
148
+
***Idle session sign-out** - Recommended
149
+
* Use this option to warn and sign-out users on unmanaged devices, after a period of inactivity
150
+
* You can configure the period of inactivity and the warning
151
+
***Network location** - Set this control to allow access from IP addresses your organization owns.
152
+
* For external collaboration, set this control if your external partners access resources when in your network, or with your virtual private network (VPN).
158
153
159
154
### File and folder links
160
155
161
-
In the SharePoint admin center, you can also set how file and folder links are shared. You can also configure these setting for each site.
156
+
In the SharePoint admin center, you can set how file and folder links are shared. You can configure these setting for each site.
162
157
163
-
158
+
164
159
165
-
If you have enabled the integration with Azure AD B2B, sharing of files and folders with those outside of the organization will result in a B2B user being created when files and folder are shared.
160
+
With Azure AD B2B integration enabled, sharing files and folders with users outside the organization results in the creation of a B2B user.
166
161
167
-
We recommend setting the default link type to **Only people in your organization**, and default permissions to **Edit**. Doing so ensures that items are shared thoughtfully. You can then customize this setting for per-site default that meet specific collaboration needs.
162
+
1. For **Choose the type of link that's selected by default when users share files and folders in SharePoint and OneDrive**, select **Only people in your organization**.
163
+
2. For **Choose the permission that's selected by default for sharing links**, select **Edit**.
168
164
169
-
### Anyone links
165
+
You can customize this setting for a per-site default.
170
166
171
-
We do not recommend enabling anyone links. If you do, we recommend setting an expiration, and consider restricting them to view permissions. If you choose View only permissions for files or folders, users will not be able to change Anyone links to include edit privileges.
167
+
### Anyone links
172
168
173
-
To learn more about governing external access to SharePoint see the following:
169
+
Enabling Anyone links is not recommended. If you enable it, set an expiration, and restrict users to view permissions. If you select View only permissions for files or folders, users can't change Anyone links to include edit privileges.
0 commit comments