To review sharing permissions before delivery, check each export folder, drive, and bucket for public links and extra grantees, then limit access to named recipients. A cloud export destination is the shared location where files wait for pickup by a customer, vendor, or partner.
Open links often stay active after pickup. That leftover access can expose customer data, financial exports, or health records. A short pre-delivery check removes public access and unneeded guests before files leave your control.
Table of Contents
- Is the SharePoint site set to Anyone?
- Who can open the Drive or Dropbox folder?
- Is the storage bucket exposed to the public?
- What should you fix before you send?
Is the SharePoint site set to Anyone?
According to Microsoft Learn, SharePoint and OneDrive offer four external sharing tiers tiered external sharing controls. The tiers are Anyone without sign-in, New and existing guests, Existing guests, and Only people in your organization. Before delivery, confirm the delivery site is not left on Anyone. Microsoft guidance also recommends requiring Anyone links to expire within a set number of days and limiting them to View-only.
That setting reduces unauthenticated access when a broad link is truly needed. Use Specific-people links for sensitive exports instead. Changing the expiration rule does not fix old links. According to Microsoft Learn, expired links do not revive, and a longer new limit does not extend existing links. Issue fresh links to affected recipients after you tighten the policy.
Who can open the Drive or Dropbox folder?
According to Google Drive Help, Drive assigns Viewer, Commenter, or Editor roles and lists each person and group in the Share panel sharing files and folders in Drive. Open that panel before delivery. Downgrade Editors who only need to read, and remove former vendors, contractors, and duplicate groups. Dropbox Help draws the same line between invited people and Anyone with the link. An Anyone-with-the-link file is effectively public.
Anyone who finds or guesses the link can open it. Avoid that setting for passports, payroll files, medical forms, or legal exports. Check group membership, not just names. A small grantee list can still hide broad access through a mailing list or shared group. Remove departed external guests and confirm the remaining names match the current delivery.
Is the storage bucket exposed to the public?
According to AWS Documentation, best practice is to block all public access to S3 buckets by default blocking public access to storage. The control has four Block Public Access settings. Enable them at both the account and bucket levels before placing export files. A bucket can still grant cross-account access through ACLs, bucket policies, and access-point policies. AWS Documentation states that IAM Access Analyzer for S3 reviews those policies and reports each public or cross-account grant with its source and access level.
Run that review before delivery. Remove unneeded public grants and narrow cross-account grants to the exact recipient account and prefix. Treat a delivery bucket as temporary. Create a separate prefix for each recipient, allow only the needed read action, and delete the objects after confirmed pickup. Do not reuse one public folder for successive customers.
What should you fix before you send?
CISA publishes testable secure-configuration baselines and assessment tools for Microsoft 365 and Google Workspace through its Secure Cloud Business Applications project. The tools are ScubaGear and ScubaGoggles. Run the relevant baseline check before external delivery to catch loose sharing defaults.
Microsoft sharing guidance points to the same practical cleanup. Move delivery files from personal OneDrive to team-owned storage so access survives staff changes. Replace broad links with Specific-people links and add expiration or passwords where available. Expired delivery links need replacement, not adjustment, so reissue links after policy changes and confirm receipt through a separate channel.
- Send with a Specific-people link, not an Anyone link.
- Set the shortest expiration that still allows pickup.
- Remove departed guests and excess Editors.
- Move the file to team-owned storage and verify the grantee list.
You Might Also Like
- Cybersecurity After a Google Account Appeal: How to Review Sessions You Do Not Recognize
- Cybersecurity: Unauthorized Gmail Forwarding After Recovery: What to Document Before Removing the Rule
- Cybersecurity: A Google Export Archive Was Leaked: How to Inventory the Services and Date Ranges Inside