SharePoint and m365 Permission Update

Dartmouth is modernizing how content is shared within SharePoint. This article explains upcoming changes on July 14 to August 14 and some of the best practices of providing access to your SharePoint site, permissions to files, and allowing external users. 

Changes to Existing Permissions

From July 14 to August 14, settings will be configured to not include Everyone Except External Users (EEEU) on new and existing SharePoint sites. Existing SharePoint sites will have EEEU programmatically removed as a one-time action. If this causes a disruption to your team's access, please contact the CTC Help Desk as access can be restored. The primary reason for this change is to enhance data security and prevent inadvertent access by apps, processes, or users. The EEEU permission setting, while useful for internal collaboration, can lead to unintended data exposure. By removing this permission, Dartmouth aims to ensure that only explicitly granted users, apps, and processes can access specific files and folders.

Direct Permissions: Users, apps, and processes granted explicit, direct access to specific files and folders are not affected and retain access.

SharePoint and m365 Settings You Should Be Aware Of

SharePoint includes several sharing options that can expose your content more broadly than intended. The following settings should generally be avoided unless you have a specific, intentional reason to use them:

• Everyone -- This group includes all Dartmouth users as well as external guest accounts in your tenant. Granting this group access means virtually anyone associated with Dartmouth, including guests who may have been added for unrelated purposes, could access your content.
• Everyone Except External Users (EEEU) -- This built-in SharePoint group automatically grants access to every Dartmouth faculty, staff, and student account. Even if someone has no connection to your work, they would have access to your site. Most site owners are surprised by how broadly this casts the net.
• "Everyone with this link" sharing links -- When sharing a file or folder, selecting this link type allows any signed-in Dartmouth user to access the item, even if they were never directly invited. These links can be forwarded or discovered in search results, making it difficult to control who actually has access.

In each of these cases, the risk is the same: content reaches people who were never specifically invited and may have no legitimate need to see it. Dartmouth's approach to data stewardship calls for sharing deliberately, with the specific people who need access.

Review Your Sites and Permissions

Conducting periodic reviews of SharePoint sites and sharing settings will ensure safe and secure data. As a site owner, you will start from a place where access is intentionally scoped, making it easier to ensure that only the right people have access to your content from the start. There are cases where sharing content broadly is intentional and appropriate, such as publicly facing department pages or institution-wide resource hubs. If you believe broad sharing is the right fit for your site, that is fine. The key is to make a conscious, informed decision about the type of data you are sharing and to confirm that nothing sensitive is included. If you are unsure, reach out to the CTC Help Desk for guidance.

How to Update Site Permissions

Remove the EEEU Site Permission

1. Navigate to your SharePoint site.
2. Click the Settings gear icon in the top-right corner and select Site permissions.
3. In the Permissions panel, click Advanced permissions settings.
4. Locate Everyone except external users in the permissions list.
5. Select the checkbox next to that entry.
6. Click Remove User Permissions in the ribbon at the top.
7. Confirm the removal when prompted.

Remove "Everyone with This Link" Sharing Links

1. Navigate to the file or folder in SharePoint.
2. Click the three-dot menu (...) next to the item and select Manage access.
3. Under Links giving access, look for any link that shows "Everyone with this link" or "People in Dartmouth with this link."
4. Click the X next to that link to remove it.
5. Confirm the removal when prompted.
6. Re-share the item directly with the specific individuals or groups who need access.

Need Help?

If you need assistance reviewing or updating your SharePoint sharing settings, please submit a ticket using the Submit a Ticket request form. The CTC Help Desk is happy to work through it with you.

External Resources

• Submit a Ticket - CTC Help Desk

See Related Articles to the right for more information.