7 steps to clean up unique permissions

cleanup-headerIn my latest post I showed you how you could limit the options to share the content in your site. I hope that you have made some decisions, so now it is time to clean up the mess.
Let me remind you why too many options to share can turn into a problem:

  • Sharing a document or list item, or using the “Get a Link” option, creates unique permissions, and that means that the permissions of a document or list item no longer follow the permissions of the site. So if you add a new group (recommended) or a new person (not recommended) to the site, this group or person will not automatically get access to those items.
  • This will lead to unexpected access denied messages and therefore Access requests.
  • Approving Access requests may lead to more unique permissions AND they give people Contribute permissions by default, which may be too much.
  • Unlimited sharing (especially with external users) can lead to your documents falling into the wrong hands.

So, how to take back control of your site after you have changed some of the settings?

Have a note-taking system ready – paper, OneNote, Notepad, document – whatever is your thing. You will need to make some notes.

1. Process pending Access requests

Go to Site Settings > Access Requests and Invitations and see who has requested access.
Click the … next to each name and add people to site groups as much as possible. If you do not see the site group mentioned, note down their names with the group that you want to add them to.

2. Remediate content with unique permissions

a. Go to Site settings > Site permissions and click on this link:

Cleanup-Show items
Show the items with unique permissions, intended and accidental. Very useful functionality!

b. You will get a pop-up with all lists and libraries that have different permissions.

Cleanup-showitemsiwhtuniquepermissions
Focus on the lists with “View exceptions”. Those contain the items where you have created unique permissions by accident.

c. The items marked as “manage permissions” are usually lists and libraries that have different permissions by design. Skip these.
d. Click on “view exceptions” for the first list or libraries that has this mentioned. You will see all documents (including pages and images) or list items that have unique permissions.

Cleanup-Documentswithuniquepermissions
List of documents (or items) that have unique permissions. Rightclick “manage permissions” and open the link in a new tab.

e. Using Rightclick > Open in new tab, click “manage permissions” for the topmost item.  (If you just click “manage permissions”, you will have to start at a. again for the next document or list item)
f. Check if there are any people mentioned that you may want to add to one of the site groups, and note down their names + intended site group.
g. Click “Delete Unique permissions” to re-inherit the permissions from the list or library.

Cleanup-deleteuniquepermissions
After noting down Kimberley B as a potential Visitor click “Delete Unique Permissions” to bring the document’s permissions in line with the rest of the document library and site.

h. Repeat steps e, f and g for the next document or list item.

3. Weed out “limited access”

Limited access is an annoying thing that tells you that there are, or have been, unique permissions – or it may mean nothing at all.
If this site has existed for some time and you do not know it very well, you can skip this step for now because you might remove people who are there for a good reason.

a. Go to Site settings > Site permissions and click on this link:

Cleanup-Show users
Show people with limited access. This can be caused by Sharing, Get a Link or accepting an Access request.

b. Check if there are any people mentioned that you may want to add to one of the site groups, and note down their names + intended site group.

Cleanup-RemoveKimB
You can remove Kimberley B from this page. (“Beperkte toegang” means “Limited Access”)

c. Remove any individual users so you are left with only the site groups.

4. Add the new users

Add the users that you noted down during steps 1, 2 and 3 to their respective groups.

5. Review the Members group

During the time that you had no restrictions, Members may have added other Members.  Review your list of Members and change their roles or remove them where needed.

6. Replace any “breaking links” on your pages

Hover over every link on every page in your site and look at the link in the bottom-left of your screen. Links of the “Can View” or “Can Edit” type  will generally have  “guestaccess”  in their link and they will cause unique permissions.

When I did not know all this yet, I had created some Promoted Links with the “Get a Link – Can View” link to a page. As soon as I created the link, the permission inheritance for the page was broken and everyone who clicked on the link was added as individuals to the page.

Cleanup-GetaLink
Link “”Document 5″has been created with “Get a Link”. The URL is: …../Team/Share/_layouts/15/guestaccess.aspx?/….

Replace every one of those links with the “Restricted Link” equivalent.

7. Monitor

Review on a regular basis if the restrictions and the cleanup work make you feel more in control of your site. Depending on your choice of measures, you may need to do more approvals from Visitors or Contributors who want to share content.

How have you dealt with the “Unholy trinity of creating unique permissions” 🙂 ? Would you like to share your frustrations or have you found a good way to deal with this that other readers can benefit from?

Image courtesy of artur84 at FreeDigitalPhotos.net

Limiting unwanted sharing and unique permissions

Preventsharing-fenceIn my recent posts you have seen that you can create unique permissions for list items and documents very easily, with

Additionally, you often add people with Contribute permissions while your normal Members group has Edit permissions (=Contribute + Manage Apps).
Plus your site members can add practically anyone to your site without informing you.

Why am I making such a fuss?

  • Maintenance and support
    Unique permissions create extra issues with access, and provide extra work for the Site owner.
    You may also need more support, although your support team might like that 🙂
  • Information security
    People with Edit or Contribute permissions can share content with external users, who then are often able to share your content with others if given those permissions. Your information may be shared with your competitors in this way!
  • Performance
    Having lots of unique and individual permissions may slow down your site.

Office365’s out-of-the-box functionality allows unlimited sharing. My own environment is like that, so all experiences that I have described before are done in the “unlimited sharing” default mode.

Fortunately, there are some options that a tenant administrator, a site collection administrator and a site owner can do to limit the potential damage.

1. Disable anonymous access

Disabling anonymous access lets you get rid of the “no sign-in required” options that you have when you get a link, or the “sign in required” when you share a folder or list item. While it may not reduce the creation of unique permissions too much, it will make it more obvious who has been given access. This will allow you to determine whether those people need to be added to a site group, or removed from your site.

Your tenant administrator can disable this at the Office365 Admin center for all Office365 applications, or at the SharePoint admin center for the SharePoint sites.

Preventsharing-GetaLink
This is Get a Link after I have disabled anonymous sharing. Only 3 options left for the Site owner instead of 5.

2. Disable external sharing

While this also will not prevent all unique permissions, it may limit them, because of sheer numbers. Chances are your colleagues will already have access to your site, making the chances of unique permissions during sharing a bit less.
Of course this will make it impossible to share confidential stuff with externals.

It is a good practice to reserve one or some site collections for sharing with externals, so you can keep the other site collections for purely internal content.
Your tenant admin can disable external sharing on various aspects at the Office365 tenant and the SharePoint admin level.  Gregory Zelfond has already documented how to do that.
By the way, Gregory has written more useful posts on external sharing.

This will give the following results, depending on whether the external user is already in your site collection or not.

preventsharing-noexternalsharing-indirectoy
This message will appear when you want to share with an external user who has been added to another (external) site collection in the tenant earlier.

 

preventsharing-noexternal-usernotindirectory
And this message I received when I wanted to share with a completely new person.

3. Change Sharing settings in your site

This will probably be in your control, so go to Site Settings > Site Permissions > Access Requests and look at the two check boxes on the top of the pop-up.

preventsharing-defaultsharingsettings
By default the access request and sharing settings are like this. Read the explanation carefully!

This will mostly influence what a Site member can do.

You have four options:

4a. Both checked: I have done my experiments with this setting. You know what that does 🙂

4b. Top checked, bottom unchecked

Share:
Member: Can share documents without approval from the site owner, but needs approval for sharing the site.
Visitor: Can share site and documents with approval from site owner.

Get a Link:
Member sees “Edit link” option
Visitor sees the “Restricted Link” option

4c. Top unchecked, bottom checked:

Share:
Member=Visitor: Can share site and documents but needs approval from site owner

Get a Link:
Member=Visitor: Restricted Link

This option brings another message to your Site Permissions page:

prebensharing-tiredofapprovals
If you get tired of approvals, you can change the settings again. (But look: no item with unique permissions…until you approve a request)

4d: Both unchecked:

Same as 4c.

So, this setting will help you to “tame” your site members, and give them the same sharing options as your site’s visitors. You will have more approvals to do, but are more in control.
But beware hitting the “Accept” or “Approve” button in sharing requests for documents or list items!

4. Remove access request email

If you can not get access requests, you can not break permissions when accepting them!

Preventsharing-noaccessrequest
You can uncheck the “Allow access requests” box and no email will be sent.

This can work in formal all-company sites with official content and little collaboration.
On the other side of the spectrum, it is also an option for sites with a strictly defined and controlled audience, e.g. a management team.
It will however be very clumsy in a project site!

But…your visitors will get a nasty error message when they try to share a document or site, and when you are combining this with options 4c or 4d, your members will experience that too.

preventsharing-noemail
Not a very nice message, and also not exactly correct. It should say “There is no email address to send the request to”,

Realize that all of these settings have been developed with a reason, so you may want to ponder what is really important for you and if you need to lock down everything or just a few features.

While you think about this, I will go and write how to check and fix the permissions, where needed, after you have taken your measures.

Image courtesy of winnond at FreeDigitalPhotos.net

Sharing = scaring (part 2)

Sharing2-imageIn my most recent post I focused on sharing documents and items by the Site owner, demonstrating that the Site owner him/herself can easily create lots of unique permissions by sharing folders, documents and items.

But what happens if a another user of your team site shares? Can a Member or Visitor create unique permissions as well, and does the Site owner know what the Site members are doing?

Once again, we start out with a team site with the standard permission sets (Owner, Member with Edit permissions, Visitor with Read permissions) and no unique permissions.

Durian Grey is a Visitor and Mystery Guest is a Member. We also introduce Kimberley B, who has no access at present.

Sharing documents/items by a Member

Now, Mystery Guest shares as follows:

  1. Durian, Can View
  2. Kimberley, Can View
  3. Durian, Can Edit
  4. Kimberley, Can Edit

The following results are as expected:

  • Document 1 does not change permissions since Durian already has Read access to this site.
  • Documents 2, 3 and 4 get unique permissions after clicking the “Share” button in the Sharing screen.
  • The persons are added as individuals to the document
  • Documents 3 and 4 have the individual added with “Contribute” while Members in this site have “Edit” permissions. (and the Share option is called “Can Edit”) So, a new role is added.

These following results were a surprise for me:

  • The documents shared with Kimberley B generate an External Sharing Invitation (access request) but the Site owner does not get an email notification.
  • Kimberley B can only share the document with existing site members when she has View permissions. but she can share the document with ANYONE, including new externals, when she has Edit permissions.
  • When Kimberley B shares with another external user this creates an External Sharing Invitation for the new person.
SharingbyexternalCanEdit
Kimberley B can share the Edit permissions for this document with everyone, even though she has no permissions on site level. Scary!

 

Sharing documents/items by a Visitor

Durian shares document 5 with Mystery Guest. He can not select Can View or Can Edit. When he clicks “Share”, he sees a message that this request is being sent to the Site Owner but that does not happen; the message goes straight to Mystery Guest. She can access in her normal role and no unique permissions are created. Phew!

Durian then shares document 5 with Kimberly B.

SharingbyVisitor
A Visitor can share but always needs approval from the Site owner.

 

When he clicks “Share” the following things happen:

  • The Site owner receives the normal “someone wants to share” email, Durian gets a copy
  • An access request in Pending Requests appears. By default, the request is for Edit (not Contribute), as an individual. The Site Owner can not select one of the permissions groups, so has to give individual permissions. 😦
  • As soon as the Site owner selects a permissions set and hits Approve, the item has unique permissions.
  • Durian receives an email that the sharing request has been accepted.
  • Kimberley B receives an email that a document has been shared.
  • Kimberley B can share the document with only existing members or anyone, according to her permissions.

Sharing a site

Since Mystery Guest has found that Kimberley has no access, she shares the complete site with Kimberley. She is not a Site owner, so she can not select a permission set when she shares the site.

As soon as Mystery Guest clicks “Share”

  • Kimberley B receives an email.
  • She is added into the Members group (even without having accessed the site).
Sharing2-KimBisaddedasmember
Uh…how does Kimberley B suddenly end up in this group?

 

Durian has the same thought.

  • He shares the site with Kimberley B.
  • His request is sent to the Site Owner and an Access Request is created.
  • The Site Owner goes to the Access Requests list and selects the Visitors group of the site and clicks Approve. (Members is the default, btw)
  • A confirmation email is sent to Kimberley B and Durian.

Now Durian wants to share the site with another external person, who has never been invited before. He can not do that.

Sharing2-Durianshareswithnsomeoneelse

What to think of this?

It is complicated!

Although a number of things are understandable this can turn into a messy site:

  • Get a Link, Share and Access Requests can all very easily create unique permissions for documents (including pages), folders and list items.
  • Members can use Get a Link and Share, create unique permissions, and add new Members, without the Site owner knowing.
  • Visitors can do less and generally need approval from the Site owner; this is better for the Site owner’s overview, but can create a lot of work because of the approval requests.
  • External users can share your document with anyone, if they have Edit permissions.

Don’t panic!

Before you start panicking, please be aware that my tenant is almost out-of-the-box and all the sharing options are turned on by default.  Tenant admins can take measures to reduce the unlimited sharing Microsoft thinks we need.
I will share those measures with you next time.

I have also found a few differences with regards to users who are mentioned in my tenant (with and without license) and who are not. When I have recovered from my current identity crisis, juggling 4 accounts and 3 browsers, I will try to find out more. 🙂

Image courtesy of marcolm at FreeDigitalPhotos.net

Sharing = scaring (part 1)

Sharing=scaring1If you thought that only “Get a Link” and Access Requests can upset the carefully constructed permissions settings in your site, you have not used “Share” yet 🙂

How “Share” works

Currently you can share a site, folders *, documents and items tem via this option. It does not work for libraries and lists, but I expect this is a matter of time.

(* only when a specific setting has been enabled)

If you select a document and click Share, or go to the Share button to share the site, a pop-up opens and you can:

  • Add the person (pick from people picker or type email address)
  • Select role (“Can View” or (the default!) “Can Edit”)
  • Add a message
  • Determine if sign-in is required (if you allow anonymous access)
  • Determine if you want to send an email (recommended; otherwise people may not know something has been shared with them)
  • If this is a site and you are the Site owner, you can select the desired permission group (recommended) or a permission level.

The person you share with will receive an email, and you will get a copy.

Sharing-2
The Sharing screen. If you share the site and are the Site owner, you will see an option to add the person to a group.

New Share interface

During my experiments, I noticed a difference in Share interface between sharing from a Document library web part on a page (screenshot above) and from the native Document library (screenshots below).

CHAOPS has already written about it.

Sharing-newShareInterface
The new Share interface. You get this when you share from the Document library itself.
Sharing9-clickonanyone
If you select a different option than “Anyone” in the screenshot above, you will see these options.

Sharing a site

Sharing a site (using the Share button top right on any page of a site) is actually a faster way to add someone to your site than going to Site Settings > Site Permissions.
From the Share pop-up you can add people to a site group.

I recommend this to Site owners.

Sharing documents/items with people who do not have access

I am quite alone in my tenant, so I can only share with externals. However, externals have exactly the same options as employees so it does not really matter. My tenant allows anonymous access, so I can decide between “no sign in required” (anonymous access) and “sign in required”.

This is my test document library.

Sharing-1

I have inherited the permissions for the Newsfeed, so I have very straightforward site permissions before I start sharing.

Sharing-3
I wish I knew how to change the permission level descriptions to English!

I share the document numbers as follows:

  1. Can View with Durian Grey, no sign in
  2. Can Edit with Durian Grey, sign in
  3. Can View with Mystery Guest, sign in
  4. Can Edit with Mystery Guest, no sign in

Without those people even accessing the documents, here’s what happens:

  • The permission inheritance for each document breaks as soon as you hit Share.
Sharing-4
All shared documents get unique permissions
  • If you do not require sign-in, the permission inheritance is simply broken with no people added or anything.
Sharing-5-anonymous access
With anonymous sharing, permission inheritance for the document breaks, nothing else.
  • If you require sign-in, the person who you share with is added to the permissions with Read (if you select “Can View”) or Contribute (if you select “Can Edit”), as an individual user, NOT in a group.
Sharing 4- signinuser added as individual
In case of “sign-in required”, you see that Durian Grey is added as individual with Contribute permissions.
  • The persons you share with get “limited access” to your site and will show up in that yellow bar. This is as expected, but be aware that this happens.

    Sharing 6- people with limited access.
    Two people with Limited Access added to your site….somewhere.

Once they have accessed the documents, nothing changes.
So you, as the site owner, have done all the damage yourself 😦

Sharing documents/items with people who have access

Let me add Mystery Guest as Member and Durian Grey as Visitor, and share some documents with them in their new status.

5. Can View with Durian Grey
6. Can Edit with Durian Grey
7. Can View with Mystery Guest
8. Can Edit with Mystery Guest

After sending out the emails this is what the permissions looked like:

Sharing 7-sharingwithmembers
Only one document has unique permissions after sharing with people who are added to the site.

Only document 6 has unique permissions: where I shared the document as “Can Edit” with Durian Grey who can only Read. That makes sense.

It is that I have given up fighting unique permissions, otherwise I would have recommended that you add all likely members for your team site into site groups. 🙂

Sharing a folder

Folders are documents, so I would expect folders to behave in a similar way as documents. I can indeed share a folder from the native Document library, with the new interface. And indeed, depending on the permissions that the audience has, I will either create unique permissions or not.

However, when I want to share a folder from the Document library web part on the homepage I get this error message.

Sharing-folderssharingdisabled

How inconsistent!

After disabling that Site Feature and trying again I get the familiar older Share pop-up.

Sharing-oldShareinterfaceforfolder
Interface when sharing a folder from a Document library web part

But hey, what is that, just above the “hide options”?

“Share everything in this folder, even items with unique permissions”. Checked by default, of course.

I can not even imagine what this will do to your permissions! When I can gather the courage, I will give it a test.

This is enough interesting news for now.

In my next posts, I will discuss what happens when a member or visitor shares. And then I will share some options to prevent unique permissions and clean your site.

Image courtesy of imagerymajestic at FreeDigitalPhotos.net

7 ways to create and foster unique permissions in your SharePoint site

SnowflakeUniquePermissionsSome people call me “obsessed” with SharePoint permissions, and especially with breaking permission inheritance from the parent.

They are correct and I’ve got good reason (or so I think): the majority of issues and support questions have to do with non-standard permissions and people not fully understanding the consequences of creating unique permissions that they or their predecessors have done, knowingly or accidentally.

So while pondering my personal branding 🙂 I thought it might be better to embrace the options that Microsoft has created for us to share freely. After all, this thing is not called SharePoint for nothing! In Office365 everything is geared towards sharing content, without any considerations or warnings that many of these options create unique permissions, so who am I to worry, or go against that principle?

And what’s more, people who create unique permissions keep me in work! There’s nothing I like better than a complicated permissions puzzle, so if I want to stay away from boring discussions about columns that do not align 100% or the exact dimensions or rotation speed of carousels, why not make sure that I create some interesting work for myself?

So, let us make sure we all share content freely and without abandon!

In order to do that, I have collected these 7 principles for site owners.

1. Never give anyone “Read” access

This restricts the options for these people to share content. You will give them ugly words to share with (“Restricted Link”…ugh!),  and they will need your approval. Come on, these are grown ups that know what they are doing! If they want to share a document, they must have a good reason. And you, as a site owner, have better things to do than approve or decline sharing requests.
Treat everyone the same and give them Contribute permissions at the very least. Who knows, they may have some great insights to add to your policy or project statement. Added April 27, 2017: And they may even help you design your homepage and other pages! Thank you for that addition, Helena! (See comments below)

2. Always use individual permissions

Well, you know there is this site group option of Owners, Members and Visitors, but who wants to be in a group, if the only thing joining you is having an interest in a document? Why bother puzzling out which group would be the best option for a person? You know it never fits 100% – this document is interesting to Stella, Eric and Tom, while the other document is interesting to Stella, Tom and Cindy. How can you make groups if every document has their own audience?
Surely your audience consist of all individuals, with individual needs. Using individual permissions will give you the most freedom to match each document with the people who really need it.

3. Break permissions inheritance freely

When in doubt, break! Or when your boss tells you so, of course. SharePoint has the option to allow access on a granular level, so why not make use of it and enjoy this to the fullest? You can pinpoint any document library, folder or even document or list item and give exactly the right individuals access.

4. Never use the “restricted link” option

Restricted…what an ugly word, it feels so….limited! Why would you want to impose restrictions? When you want to share content, select the “Can read” link to make sure that your intended audience can read it and not bother you with requests for access. Even better, use the “Can Edit” option. After all, your audience may have great ideas to share in that document. Policies and other controlled documents are a thing of the past, let’s crowdsource them all!

5. Immediately accept any Access Request

Hit the “Accept”  button and do it quickly, or you may lose a perfectly good reader or editor of the page or document you are sharing. Be ashamed of yourself that you have excluded someone from your content! Rejoice that they go to so much trouble to see it!
Only then, but only if you have the time, find out why and to which content this person wanted access.

6. Never review your permissions

You may be tempted to add Caroline, John and Marcia into a group if you see their name appear on every document, but who are you to decide they need to be grouped? As mentioned in paragraph 2, they are all unique individuals and throwing them into a group only because they read or edit the same documents does not do justice to their uniqueness. And the excuse of “groups are easier to manage for me” is a bit selfish, don’t you think?

7. Stop managing permissions altogether

This may be the best advice anyone can give you.
After all, is it not a bit conceited to say that “you own this content” or “you are managing this site”? The other people in the site know very well what they are doing, and they will take care of ensuring that this content is available to all the right people! Together you know who needs, or is interested in, your information. Over time, your content will gravitate towards exactly the correct audience.

To make sure that your unique permissions grow fast enough, you may want to enter in a competition with other site owners. It may well be that companies like ShareGate have a tool that can measure unique permissions. If they don’t, I suggest they develop one quickly.
Let me know how it goes!

Image courtesy of digitalart at FreeDigitalPhotos.net 

Get a Link – Get a Break!

getalink-brokenchocolate2As I am writing help materials for our new intranet I do not only have to think about “HOW do you do this” but also “WHY would you do this” and “How can you do this BEST, without spending too much time, adding maintenance or messing things up?”

With the migration of content to the new platform, many Site Owners need to rework their publishing pages. Generally these pages contain (clickable) header images, Promoted Links, Summary Links and links in the text.

On the old platform, when you want to grab the link to a document or image, you go to the library, right click on the name and select “Copy Shortcut” from the pop up. This is no longer available in SharePoint Online.

So, how does one get a link in SharePoint Online?

I have found 3 ways to link to a document, page or image:

  1. In Summary Links as well as the Rich Text Editor on a page (Wiki page style), you can browse for the link to a document or image that lives in your site or site collection.
    getalink-insertlink
    Insert > Link > From SharePoint will allow you to browse the libraries and lists in your site and link to the desired content.

    getalink-summarylinks
    When creating Summary Links you can browse for the content in your site.
  2. You can open the item and grab the URL from the address bar.
  3. There is the new Get a Link option, which you will see when you select a document or image from a library, in the Action Bar (is that what it’s called?) and the pop up menu.
    getalink-actionbar
    The Action Bar shows the Get a Link option when you select an item

    getalink-actionbar-gif-popup
    When you click the … behind an item name, you will see this in the pop up

The users in my company are all accustomed to grabbing a link when they want to share a document via email or on Yammer, so I think this “Get a Link” will appeal to them.

However, at first glance I see 5 different options. What to select?

getalink-options
5 options to Get a Link? Please note that the “no sign-in required” options can be disabled by the tenant administrator. This allows you to share links with anyone, in and outside of your company.

Let’s find out how this works!

Microsoft has already written about this but it is not very detailed.
So, I have created a brand new site in my own tenant. In this site I have uploaded 5 documents, each named after the action I will take.

getalink-documents

I assume the file type is irrelevant so I have used a mix of Excel, Word and PowerPoint.

Please note I am the tenant admin, so I am not a normal Site Owner. Some things may work differently for a regular Site Owner with Full Control.

My tenant is almost out-of-the-box and external and anonymous sharing has been enabled on all site collections.

How to use Get a Link:

  1. Select the document and click “Get a Link”
  2. Select one of the 5 options
  3. Click “Create” (if the link has already been created earlier you will immediately see “copy”
  4. Click “Copy” and the link will be added to your clipboard
  5. Paste wherever you need it.

You can remove a link if you longer want to share. This means the link will be disabled if someone clicks on it.

For links with “no sign-in required” you can set an expiration date. This means the link will no longer work if someone clicks on it after the expiration date.

getalink-expirationdate
For “anonymous sharing” you can set an expiration time.

Results

  1. The links look as follows:

Restricted link:

https://company.com/Sharing/Shared%20Documents/GetLink-RestrictedLink.pptx?d=wa1065f209e79474cb70b1d349a3d5c1c

View Link – account required:

https://company.com/Sharing/_layouts/15/guestaccess.aspx?guestaccesstoken=g5GzCR4X%2bSQeQkoUVxhvy6ObgkIgAOAwWPxUubf%2bNlY%3d&docid=2_061f40460a0bb4a509b5f126109e2f28e&rev=1

View Link – no sign-in required

https://company.com/Sharing/_layouts/15/guestaccess.aspx?docid=0d7dc303b58164d169fe1e15c05981740&authkey=Acc4tb7-2Nb5GYqUQPj4Oy0

Edit Link – account required

https://company.com/Sharing/_layouts/15/guestaccess.aspx?guestaccesstoken=OygCzI%2f3Nkr8YKUhpYNPucCNr3H7x4zTfJowLrST0lI%3d&docid=2_17f6bad80545a42428c32907a3503e6f4&rev=1

Edit Link – no sign-in required

https://company.com/Sharing/_layouts/15/guestaccess.aspx?docid=11bf22e7919224e2987caf7ea39f9f4f5&authkey=AReBJ-AIIrhwFnuFeCqR1e

2. Using the “View” and “Edit” links will break permission inheritance for the document as soon as you hit “Create”.

getalink-what
Pardon my French, but what did you just write there?

Yes, you may want to read this again:

Using the “View” and “Edit” links will break permission inheritance for the document as soon as you hit “Create”.

I was a bit worried about the word “guest_access” that I saw appearing in 4 of the 5 links, so I decided to check the permissions of my site.
Microsoft mentions this in the small letters of their post, but it is easily overlooked.

You know you can now see immediately if you have items with different permissions in your site. That is very convenient. Normally, only the Microfeed has different permissions, but now my Documents have too!

getalink-brokenpermissions
The document library has “exceptions”. That means: some items have different permissions.
getalink-4outof5
Only the “Restricted Link” does not break permission inheritance!

4 of the 5 docs have broken permissions inheritance! The permissions have not changed yet, but the inheritance has broken. This may not appear to be a big deal now, but if you ever happen to add a new group or individual to your site, which is not unlikely, you will have to remember to give them access to these documents.
Do you seriously think any Site Owner will remember this? Or have the time for that?

More scary and inconvenient findings

  • As soon as someone clicks on a link they are added to the permissions of the document, regardless of their existing role in the site.
getalink-added-after-clicking
I am the tenant admin, and have Full Control of this site, yet I am added as soon as I click the link.
  • People in the Members group get all the options for “Get a Link” as well!
    I have tested this in my work environment and it turns out Members can see and use the “view” and “edit” options so they can break the permission inheritance of documents without the Site Owner being aware!
  • You can only find out which links have been created by checking the options for each document. Click “remove” if you see that an unwanted link has already been created. Now go find out which of your links (In a text, in Summary Links etc.) used this link 😦
  • You can remove the link, but the permission inheritance is still broken.
  • You can only “delete unique permissions”  per document, so you have to go to Site settings > Site permissions > Show items with different permissions > View Exceptions > Manage permissions > Delete unique permissions.
    This is a tedious process.

I think this can turn into a serious issue. I have found that many Site Owners do not fully understand the consequences of broken permission inheritance, and do not understand the extra maintenance and support issues involved. I have tried to tell them NOT to break permission inheritance unless it is really needed, and to never do this on a document or item level.
And even if they know, it is a time-consuming job to reset the permissions.

Also, why all this complexity for just getting a link? I think only the “Restricted link” would be sufficient. Who would ever want to use the “edit” options when linking to an image? Why would you use the “Get a Link” option to share via email if there is also a “Share” option which sends an email? (and which, in some cases, asks permissions to the Site Owner first?)

What would I recommend if you need a link?

  • Use the “Insert > Link > From SharePoint” option to link to a document or image when working in the text editor of a page
  • Use the “Browse” option when creating Summary Links
  • Use “Get a Link > Restricted View” when you want to get a link otherwise. This respects the permissions of your library.
  • Instruct your site Members about the dangers of Get a Link and ask them to use the Restricted Link.

What are your experiences with the Get a Link functionality? Have you been able to reduce the scope and if yes, how? I would appreciate to hear and learn from you!

Kitten image courtesy of Top Photo Engineer at FreeDigitalPhotos.net. Text added by myself.

No editing pain with the details pane

docpane-picredRecently I sang the praise of the details pane in SharePoint document libraries, because I firmly believe this will make it easier for site owners (and supporters) to know what has happened to their documents.

But there is more to that pane than just information about the library. It also shows useful info about each document.

When you upload a document to a library, the newly added document will be selected and the details pane opens.

docpane-justuploaded
When you upload a document, the details pane opens with a warning that some required metadata are missing.

On the details pane you see the following from top to bottom:

  • A preview of the document’s first page
  • Document name, size and modified date.
  • A warning that this document misses mandatory properties
  • The properties
  • Recent activities for this document and by whom
  • Who it has been shared with
  • Document information such as file type, path and size
    docpane-firstscroll
    Top part of the document details pane
    docpane-secondscroll
    The second part of the document details pane

    docpane-thirdscroll
    The bottom part of the document details pane

There are now three ways to edit the properties of the document.

1. Traditional: Via the document menu

-Click … behind the document name, click “More” in the menu and then “Properties”.
You will go to the document properties page.

docpane-traditionaledit
The document properties page

-Click “Edit all” and you will go to the edit page
-Make edits and click “Save”
-You will go back to the document item page, as per screenshot above

Hmm…you will have to find your way back to the document library again 😦 .

2. Via the “Edit all” link

-Click “Edit all” in the details pane, next to “Properties”
-You will immediately go to the edit page of the item

docpane-edit-all
The edit page.

-Make edits and click “Save”
-You will go back to the library.

Now, that is better. It saves me a few clicks and I stay in the context of the library.

3. In the details pane

-Click on the field below the column name (in this example: Name, Title and Topic).
-The field will now open up and can be edited
-When you have made your edits, click below the edited field
-You will see “saving”, “saved” and then the field will look normal again.
-Click on the next field and repeat.

I think this will benefit from a short video demo. Please watch in full screen mode and look at the right side.

Yay, this is very fast and I do not even have to leave my document library!

This also works for lists. You can even add an attachment to a list item from the details pane. (I am not a big fan of attaching documents to list items, but that is another matter)

docpane-list
Editing properties of a list item

Some quirks!

  1. If you have many required properties and they are all Choice or Lookup fields with many choices, you will have to do a lot of scrolling. Using “Quick Edit” (the former “Edit in Datasheet”) may be a better way.
  2. The “wobbling” caused by the words “saving” and “saved” appearing and disappearing makes me a little seasick, especially when I had to edit about 50 documents recently  🙂 . In that case, “Quick Edit” may be better.
  3. There is not much space available to show texts, so if you have a long description, you may lose track of what you are writing. Save your text to see if your sentence still makes sense. Using “Edit all” (option 2) may be easier, although the space there is limited, too.
  4. In older SharePoint versions, a document was only visible to the audience once it had been properly checked in with all required metadata. This appears to be no longer needed. So there is a larger risk of documents in your library that do not have all required metadata added.
  5. This is a very new way of editing SharePoint stuff, so will need communication and adoption efforts.I can imagine that people will be looking for an “Edit”or “Save” button.

Conclusion

Editing a document’s properties in the details pane is a very easy way to adjust metadata while staying in the context of your work. It does have a few quirks, so may not be the best option for every purpose. I think it is great for adding metadata to newly added documents, or for making small adjustments to a limited number of documents.

What do you think of this? Do you like this pane or not, have you found any other gotchas? Is this something you actively communicate to your users? Please let me know!