{"id":13831,"date":"2017-11-21T00:00:00","date_gmt":"2017-11-21T05:00:00","guid":{"rendered":"https:\/\/centricconsulting.com\/post\/office-365-sharing-data-with-external-users_portal\/"},"modified":"2021-12-15T00:14:32","modified_gmt":"2021-12-15T05:14:32","slug":"office-365-sharing-data-with-external-users_portal","status":"publish","type":"post","link":"https:\/\/centricconsulting.com\/blog\/office-365-sharing-data-with-external-users_portal\/","title":{"rendered":"Office 365 Information Security: Sharing Data with External Users"},"content":{"rendered":"<h2 style=\"text-align: center;\"><em>Before external users can access your data, you should consider your organization&#8217;s existing policies and the information security risks.<\/em><\/h2>\n<hr \/>\n<p>When it comes to collaborating, <a href=\"https:\/\/centricconsulting.com\/blog\/the-outlook-is-good-for-the-new-office-365-outlook-updates\/\">Office 365<\/a> allows colleagues to check availability in Outlook, schedule a <a href=\"https:\/\/centricconsulting.com\/blog\/microsoft-teams-adoption-governance-skype-for-business-more_enterprisecollab\/\">Skype for Business<\/a> meeting, and share files in SharePoint, OneDrive for Business, or Office 365 Groups. While sharing within your organization is fairly simple, sharing with external users requires some planning.<\/p>\n<p>External users can be anyone outside your organization &#8211; from partners to customers. A technical description of an external user is someone who does not have an account registered or licensed in your Office 365 tenant.<\/p>\n<p class=\"intro-text\">There are two types of external users \u2013 authenticated and anonymous:<\/p>\n<ul>\n<li><b>Authenticated users<\/b>\u00a0&#8211;\u00a0 Those who have a Microsoft account from another Office 365 subscription. Authenticated users can have the same permissions as any of the internal users within your organization. You can assign a license to them.<\/li>\n<li><b>Anonymous users<\/b>\u00a0&#8211; Those who can access a folder or document via a shareable link. Anonymous users can view, edit, or upload to the folder without having to log in with a username or password. Anonymous users cannot access sites, and you cannot assign licenses to them.<\/li>\n<\/ul>\n<h2>External Sharing: Where Do You Start?<\/h2>\n<p>Before you start allowing external users to access your data, you should consider the existing policies set by your organization.<\/p>\n<p class=\"intro-text\">Some of these policies may include:<\/p>\n<ul>\n<li>Is external sharing allowed for anyone (anonymous) or just authenticated users?<\/li>\n<li>Which domains should you allow or block in Skype for Business?<\/li>\n<li>What types of content should you not (or cannot) store in O365?<\/li>\n<li>Who can (and should) extend an invitation to an external user?<\/li>\n<\/ul>\n<p><em>You may also find that your organization does not have policies in place that address the sharing of content with external users except through email. If this applies to your organization, you must configure your Office 365 tenant to limit external sharing until the proper policies and controls can be put into place, limiting the risk to the organization.<\/em><\/p>\n<h2>What Are Some Information Security Risks?<\/h2>\n<p>While external sharing is a great way to extend your organization to your partners, suppliers, and perhaps even your customers, you must account for certain risks.<\/p>\n<p class=\"intro-text\">Some of those risks include:<\/p>\n<ul>\n<li>Accidental sharing of sensitive content<\/li>\n<li>Sharing of content with other unintended external users (external users with full control might be able to do this)<\/li>\n<li>Changes made by anonymous users, which you cannot track<\/li>\n<\/ul>\n<p><em>While these risks &#8211; and potentially others &#8211; may apply to your organization, there are processes, settings, and tools within Office 365 that can mitigate the risks.<\/em><\/p>\n<p class=\"intro-text\">Protect your corporate assets and intellectual property by making sure you:<\/p>\n<ul>\n<li>Implement and enforce governance for external sharing<\/li>\n<li>Consider using Azure Rights Management (RMS) to encrypt and restrict sharing of the data<\/li>\n<li>Implement Data Loss Prevention (DLP) policies to detect sensitive data automatically<\/li>\n<li>Send links, not attachments<\/li>\n<li>Grant minimum level of permissions to external users<\/li>\n<li>Disable external sharing on-site collections with sensitive data<\/li>\n<li>Disable anonymous sharing<\/li>\n<\/ul>\n<h2>What Can You Share With External Users?<\/h2>\n<p>External sharing can be configured separately for different capabilities in Office 365, but primarily for SharePoint Online, OneDrive for Business, Outlook, Skype for Business, and Office 365 Groups.<\/p>\n<h4>SharePoint Online and OneDrive for Business:<\/h4>\n<p>You can share an entire site, lists and libraries, and documents. Keep in mind that external users will need to authenticate to see all of these items while anonymous users can only see documents. Additionally, SharePoint gives you the ability to limit users who can share with external users.<\/p>\n<h4>Office 365 Groups:<\/h4>\n<ul>\n<li><b>Conversations \u2013 <\/b>External users don&#8217;t have<b>\u00a0<\/b>access to conversation history, but they may participate if they receive an e-mail from a distribution list<\/li>\n<li><b>Files, Notebook, and Site \u2013 <\/b>You can share an entire site, lists and libraries, and documents<\/li>\n<li><b>Calendar<\/b> \u2013 No access<\/li>\n<\/ul>\n<h4>Exchange (Calendar):<\/h4>\n<p>You can share free or busy information with external users that include: time slots only, subject and location, or full details.<\/p>\n<h4>Skype for Business:<\/h4>\n<p>You can schedule meetings or chat with external users.<\/p>\n<h3>Conclusion<\/h3>\n<p>When it comes to sharing or collaborating with partners and customers, it is critical to include external sharing as part of your Office 365 governance and security planning.<\/p>\n<p><strong>Remember that a governance plan is not a guarantee for security compliance.\u00a0Users and administrators must observe and follow good practices and policies to minimize the risks.<\/strong><\/p>\n<p>There are many aspects to external sharing that are unique to every organization. Your organization should make decisions on external sharing policies during the configuration planning phase for an Office 365 implementation project. That way, your organization can realize the value of Office 365 without not compromising your intellectual property, corporate assets, or legal compliance.<\/p>\n","protected":false},"excerpt":{"rendered":"<p>Before you allow external users to access your data, consider your organization&#8217;s existing policies and the information security risks.<\/p>\n","protected":false},"author":146,"featured_media":28589,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"_acf_changed":false,"_oasis_is_in_workflow":0,"_oasis_original":0,"_oasis_task_priority":"","_relevanssi_hide_post":"","_relevanssi_hide_content":"","_relevanssi_pin_for_all":"","_relevanssi_pin_keywords":"","_relevanssi_unpin_keywords":"","_relevanssi_related_keywords":"","_relevanssi_related_include_ids":"","_relevanssi_related_exclude_ids":"","_relevanssi_related_no_append":"","_relevanssi_related_not_related":"","_relevanssi_related_posts":"","_relevanssi_noindex_reason":"","footnotes":""},"categories":[1],"tags":[],"coauthors":[15632],"acf":[],"publishpress_future_action":{"enabled":false,"date":"2024-07-31 12:41:55","action":"change-status","newStatus":"draft","terms":[],"taxonomy":"category"},"_links":{"self":[{"href":"https:\/\/centricconsulting.com\/wp-json\/wp\/v2\/posts\/13831"}],"collection":[{"href":"https:\/\/centricconsulting.com\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/centricconsulting.com\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/centricconsulting.com\/wp-json\/wp\/v2\/users\/146"}],"replies":[{"embeddable":true,"href":"https:\/\/centricconsulting.com\/wp-json\/wp\/v2\/comments?post=13831"}],"version-history":[{"count":0,"href":"https:\/\/centricconsulting.com\/wp-json\/wp\/v2\/posts\/13831\/revisions"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/centricconsulting.com\/wp-json\/wp\/v2\/media\/28589"}],"wp:attachment":[{"href":"https:\/\/centricconsulting.com\/wp-json\/wp\/v2\/media?parent=13831"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/centricconsulting.com\/wp-json\/wp\/v2\/categories?post=13831"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/centricconsulting.com\/wp-json\/wp\/v2\/tags?post=13831"},{"taxonomy":"author","embeddable":true,"href":"https:\/\/centricconsulting.com\/wp-json\/wp\/v2\/coauthors?post=13831"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}