Question 1

What SharePoint security services does CNEXT offer?

Accepted Answer

CNEXT SharePoint security: permission model design and remediation, external sharing policy configuration, Sensitivity Labels for SharePoint (Purview), DLP policies for SharePoint and OneDrive, SharePoint Data Access Governance (DAG) reports (overshared files), Conditional Access policies for SharePoint, SharePoint audit log monitoring and FADP/nDSG compliance assessment.

Question 2

How should SharePoint permissions be structured for a Swiss company?

Accepted Answer

CNEXT recommends: group-based permissions (Entra ID security groups, not individual users), minimal permission levels (Contribute where edit is needed, Read elsewhere), no broken inheritance at item level where possible (permission management becomes unmanageable at scale), and regular access reviews via Entra ID Identity Governance.

Question 3

What is SharePoint external sharing and how should it be controlled?

Accepted Answer

SharePoint external sharing allows sharing sites, folders or files with people outside the organisation. CNEXT configures sharing policy at the tenant and site level: 'Anyone with the link' (anon), 'Authenticated guests' (B2B), 'Existing guests only', or 'No external sharing'. For most Swiss companies CNEXT recommends 'Authenticated guests only' as the tenant default.

Question 4

What are DLP policies in SharePoint?

Accepted Answer

Data Loss Prevention (DLP) policies scan SharePoint content for sensitive data (IBAN numbers, AHV numbers, credit card numbers, passports) and trigger actions: notify the document owner, restrict sharing, apply a Sensitivity Label, or block the content from leaving the tenant. CNEXT configures Swiss-specific DLP policies for FADP compliance.

Question 5

What is SharePoint Data Access Governance (DAG)?

Accepted Answer

SharePoint DAG reports (in Microsoft Purview) show: sites with 'Everyone' or 'Anonymous' sharing, files shared with external users, sites with overly permissive access, and sensitivity label coverage. CNEXT runs DAG reports as a starting point for every SharePoint security assessment – typically identifying 20–50 overshared sites in large tenants.

Question 6

What are Sensitivity Labels in SharePoint?

Accepted Answer

Sensitivity Labels (Purview Information Protection) classify SharePoint sites and documents: Public, Internal, Confidential, Highly Confidential. At the site level, a label controls: who can access (guest access on/off), external sharing policy and whether the channel meeting/chat content is encrypted. CNEXT implements site-level and document-level Sensitivity Labels.

Question 7

What is Conditional Access for SharePoint?

Accepted Answer

Conditional Access can restrict SharePoint access based on: device compliance (only Intune-managed devices), location (only from Switzerland/EU), user risk level (block risky sign-ins), or grant access with download restrictions (view in browser only, no download for unmanaged devices). CNEXT designs Conditional Access policies for SharePoint that balance security and usability.

Question 8

How does CNEXT harden SharePoint against ransomware?

Accepted Answer

SharePoint ransomware protections CNEXT implements: OneDrive/SharePoint versioning (restore previous versions), Microsoft 365 Backup (separate backup with point-in-time restore), Defender for Cloud Apps (detect mass download of files – early ransomware signal), MFA required for all SharePoint access and privileged access controls for SharePoint admins.

Question 9

What are SharePoint site access reviews?

Accepted Answer

Site access reviews are periodic audits: who has access to which SharePoint sites? CNEXT implements automated access reviews via Entra ID Identity Governance: site owners review their site members quarterly, approve or revoke access, with automated revocation for non-responses. Critical for sites containing personal data or financial information.

Question 10

How does CNEXT audit SharePoint sharing activity?

Accepted Answer

CNEXT uses the Microsoft 365 Unified Audit Log (UAL) to monitor SharePoint sharing: files shared externally, anonymous links created, permission changes, mass downloads and guest access grants. CNEXT builds a Power BI SharePoint security dashboard from UAL data and configures Microsoft Sentinel alerts for high-risk sharing events.

Protect Your Data Securely

Enterprise-Grade Security

Permissions

Authentication

Audit Logging

Compliance Center

Encryption

Data Loss Prevention

What is SharePoint security in Microsoft 365?

Benefits of SharePoint Security

Frequently Asked Questions about SharePoint Security

Reference Projects

Global teams informed, collaboration without borders – intranet for Steelco-Belimed

Connected, mobile, modern – an intranet AEW employees use every day

Cases handled faster, less paperwork – digital case management for Canton of Bern (WEU)