Security & Controls - Content and Chat Controls setting

Andries

Good Day All.

I would like to change the settings of the "Content and Chat Controls" from "Published sheets are available to anyone with link" to "Published sheets are available to users in the owner's account".

I want to do this for all categories.

My question is if this will break any of the links we shared so far or published content?

Users will be added to our account before the change is made but I want to be sure none of the links we made or items we published will have to be re-shared or re-published?

Thank You Kindly for any assistance.

Genevieve P.

Hi @Andries

@Lachlan Stead is correct! As long as the currently published links already have the correct privacy setting (e.g. they're already set to only be shared to users in your account) then the links will be active.

Keep in mind that if you have any published URLs that have been shared out with the privacy set to anyone with the link, this change will then affect those shared links. Does that make sense?

Cheers,

Genevieve

Lachlan Stead

Put it this way, doing this on an individual sheet makes no change to the URL, so I don't know that it would be any different when applying the change at an org level. In saying that though, someone more familiar with these controls could probably confirm.

Genevieve P.

Hi @Andries

@Lachlan Stead is correct! As long as the currently published links already have the correct privacy setting (e.g. they're already set to only be shared to users in your account) then the links will be active.

Keep in mind that if you have any published URLs that have been shared out with the privacy set to anyone with the link, this change will then affect those shared links. Does that make sense?

Cheers,

Genevieve

Andries

Thank you very much for the assistance.

It makes sense and I thought as much but wanted someone with more knowledge on the matter to confirm.

Thank You Kindly.

Marlana K.

@Genevieve P. Quick additional question on changing these control settings, what happens with items that are not currently published? I updated our Publishing settings this week restricting them but noticed on several unpublished items when selecting to publish them the option for "Available to anyone with the link. This may expose sensitive information from this sheet to anyone with the link" was still available.

Genevieve P.

Hi @Marlana K.

Items that are not currently published will take on the new security controls as well; is it possible that these items are owned by users outside of your plan? Or that the security settings were not updated in the way that perhaps you had intended?

Marlana K.

@Genevieve P. the items that are not currently published did not take on the new security controls. I have had several on our team review and we all have the same result unpublished items when selecting "Publish" the available to anyone option is still available for all asset types. We have verified the settings as well. I will be generating a support request as we intentionally changed the settings to prevent the publishing being available to anyone with the link. We have been conducting a security assessment for the past 2 weeks to ensure our account is as secure a possible.

Genevieve P.

Hi @Marlana K.

You're correct, un-checking that option should mean that you see this in your newly published Dashboards:

However keep in mind that those Dashboards/Sheets/Items would need to be owned by members of your specific plan. If you have other assets shared to you as an Admin, but the owner's plan is different to yours, your security controls won't affect those items.

Can you double check who the Owner of that Dashboard is listed as? Can you verify they're a member of your plan?

Thanks!

Genevieve

Marlana K.

@Genevieve P. I opened a support ticket which lead to the discovery of the random items being owned by someone outside of Genoahealthcare.com. What has me perplexed is that the sheets appear to be created within our account when viewing the properties and they also display our branding. This user is part of a domain that is also part of our safe sharing. This is actually a situation where the employee actually is a cross employee. he has a Genoa email and laptop with an unlicensed user in Genoa Smartsheet and he has an Optum email and Optum laptop with a licensed Smartsheet in the Optum Smartsheet account. What is even more interesting is that in the Sheet Access report his access shows as "Admin" and on the actual workspace and assets he is owner and when you pull properties it shows he created the assets. How can a user that logs into Optum's Smartsheet create sheets in Genoa is a bit perplexing.

Thoughts? What am I missing here?

Genevieve P.

Hi @Marlana K.

Since this is a public Community, visible through Google and public search engines, I've deleted out the sensitive content from your images above.

Licensed users can create items. They can then share those items to anyone - unless their System Admin has implemented certain sharing restrictions.

It sounds like since this employee doesn't have a license on your plan, they're creating assets on their other plan and sharing them to you. This does mean you do not have control over those assets, since they're "owned" by that other plan (where the license resides) not by your plan.

If the user is creating assets that actually have to do with your company, I would recommend having them transfer ownership to someone who has a licensed on your plan instead. This will enable you to retain security over those items.

Let me know if that helps!

Genevieve

Marlana K.

Genevieve,

Thanks for the removal of those sensitive items! I disagree that these items are being created in his account if that were the case their branding would be on the sheet not ours. Just like the sheets that Cloudsmart shared with me show their Branding . The workspace is owned by my team. I am going to have him give me ownership of 1 sheet to see if our settings apply when he does so.

Genevieve P.

Hi @Marlana K.

If the Workspace is owned by your team and you have set branding on it, then items created within that Workspace will have your branding (even if it's an outsider that created the item). Does that make sense?

Marlana K.

@Genevieve P. Yes that does make sense. Trying to secure our account has become quite the chore. Unfortunately with the new Asset Management piece allowing those individuals outside of our company that have Admin Access on assets to approve sharing it has created a concern. While I can tell individuals NOT to share above editor cannot share access and viewer for individuals outside our domain I have no way to enforce it. I have access to 127 of our 247 workspaces where if needed I can downgrade access. We have used the new User type report and sheet access report to review what is out there and reach out to have owners downgrade access.

As always Thank you for your help!

Genevieve P.

Hi @Marlana K.

The sheet access report is what I would have recommended as well, I'm glad you were able to find this.

Marlana K.

@Genevieve P. Now if only there was a workflow (automation) report that contains Workspace Name, Sheet Name, Sheet Owner, Workflow Name, Workflow ID, Automation Permissions, the email addresses the notifications are being sent to and if the message includes links to the sheet and any fields. I know I have found some when assisting others with their sheets that contain sensitive data that is being sent out 😣 I do believe I put a product idea in for this already!