SharePoint Security Guide

Sensitive data may be stored in SharePoint. However, it is essential to configure the site so that data is protected. This section provides a walkthrough for creating a new SharePoint Site with a secure configuration.

1. Log in to Office 365, then navigate to the SharePoint app.
2. Click Create site in the top left corner to create a new site.
   
3. From the window that appears, select Teams Site.
4. Fill out the Site Information such as site name and description. In the Privacy Settings box, select Private, then select Next when you are done.
   
5. Use the Who do you want to add? window to add people–by name or email address–as either site Owner or site Member. When you are done, click Finish.
   Note: The number of site owners needs to be as small as possible; usually, there only needs to be one. The site creator is automatically a site owner. All other team members can be added as site members. Site members will have edit permission to all files on the site. Later we will cover how to give read-only access to members.
   
6. To set controls for sharing and adding new members, click the top-right gear icon for setting options, then select Site permissions from the the drop-down menu.
   
7. Use the site permission panel to invite more new members, change the existing user and group access level, and change how members can share.
   Note: Clicking the Advanced permissions settings link opens a new window that offers the same functionality as the current panel.
   
8. Click Change how members can share, then select the third option from the Sharing permissions window.
   Note: Only site owners can share a file outside of the site.
   
9. Set Allow access requests to Off, then click Save.
   Note: This means that anyone interested in joining the site will need to contact the site owner directly.

Your site is ready for sensitive data. It is the responsibility of the site owner to make sure the secure configurations stay intact. The site owner must continue to monitor site members and remove anyone who no longer needs access.

Permission levels for users and groups will probably need to change through the site’s lifecycle. To change user and group permission levels:

1. Click the top right gear icon for setting options, then select Site permissions from the drop-down menu. For more information, see the sharing settings at the site level steps.
2. All current team members’ permission levels can be viewed on this panel. The drop-down arrow below each user or group will allow the site owner(s) to change the permission level. Any user or group with full control will be list in the site owner section.
   Note: The site owner group needs to remain as small as possible. Any user or group with edit permission will be listed in the site member’s section. Any user or group with read permission will be listed in the site visitor section.
   

It is the responsibility of the site owner to manage who needs edit or read-only permissions. If a user or group no longer needs any access to the site, they can be removed entirely from this panel.

UPMC Users can access Pitt owned SharePoint Content as External Collaborators. See Instructions above for further details.

If a user has both a Pitt and UPMC account, it is preferred to use the Pitt account for accessing Pitt SharePoint content.