SHAREPOINT CONSULTING

No, SharePoint is here to stay. Microsoft is making big investments in SharePoint Online, its integration with Microsoft Teams and other products from the Microsoft 365 suite such as the native integration with Power Automate and PowerApps. We can only guess if and when we will get a newer version of SharePoint on-premises, but the thousands of hybrid deployments are proving that organizations in specific industries and jurisdictions still have a valid need for an on-premises deployment while enjoying the benefits of the cloud, too.

• OneDrive for Business is a cloud storage space that is tied to an individual user account. It is where a user would typically start working on a document in a drat before sharing it with colleagues for collaboration or moving it to a Microsoft Teams or SharePoint Online space. If a user leaves the organization, their content in OneDrive for Business will get deleted in 30 days by default. Microsoft Teams utilizes OneDrive to store files send in private chats and recordings of meetings that were held outside of a Teams channel. OneDrive has a limited amount of space, typically 1 TB per user.

• SharePoint Online is a team space for collaboration that is tied to any individual user account, but rather a group of people who upload, share and collaborate on the same content. If a person leaves the organization, their contributions in SharePoint will stay intact. SharePoint Online is the main backbone of Microsoft Teams as it comes to File storage. All files uploaded in a channel as well as channel meeting recordings are stored in SharePoint Online. SharePoint Online provides more storage space than OneDrive, typically 25 TB + 0.5 GB per licensed user.

SharePoint Online is a world-renowned online service backed by one of the top cloud providers – Microsoft. It provides industry standard security features like:

• MFA (Multi-factor Authentication)
• Encryption with Customer Key and Double Key Encryption
• Information Rights Management
• Robust permission management structure
• Support for Sensitivity labels and DLP (Data Loss Prevention) policies
• Audit logging of all user and admin activities
• Secure collaboration with Guests based on whitelisted domains
• Backup, High Availability and Disaster Recovery that is handled by Microsoft
• Customer Lockbox, allowing you to approve access of Microsoft support engineers to your data during troubleshooting of issues 

• Setup a governance process and permission management strategy
• Follow the principle of least privilege (do not provide more access than needed)
• Define policies for syncing content to devices with the OneDrive sync client
• Implement proper sharing controls (e.g., no Guests) in the SharePoint Admin Center 
• Implement Customer Key or Double Key Encryption for SharePoint Online sites
• Use Sensitive Info types to detect sensitive information in the content
• Use Sensitivity labels to protect and encrypt information matching sensitive info types
• Use DLP (Data Loss Prevention) policies to restrict sharing of sensitive information
• Enable Audit logging for Microsoft 365, including SharePoint Online
• Enable ATP (Advanced Threat Protection) features like ATP Safe Attachments
• Enable MFA (Multi-Factor Authentication) for all users
• Train your users. What you do as an organization to enforce security is a vital part of it.

All customer files in SharePoint Online are protected by unique, per-file keys that are always exclusive to a single tenant. The keys are either created and managed by the SharePoint Online service, or when Customer Key is used, created, and managed by customers. When a file is uploaded, encryption is performed by SharePoint Online within the context of the upload request, before being sent to Azure storage. When a file is downloaded, SharePoint Online retrieves the encrypted customer data from Azure storage based on the unique document identifier and decrypts the customer data before sending it to the user. Azure storage has no ability to decrypt, or even identify or understand the customer data. All encryption and decryption happen in the same systems that enforce tenant isolation, which are Azure Active Directory and SharePoint Online. Microsoft recently announced the support for Double Key Encryption, where both keys are owned and stored in a customer-controlled environment.