Currently in the Admin Center's Security & Controls section, we can set one of two options for each type of Smartsheet resource:
- Published <resource> is available to everyone
- Published <resource> is available to users on the same plan/owner's account
I am proposing a third, intermediate option:
- Published <resource> is available to everyone in whitelisted domains and users on the same plan/owner's account
Specifically, what I mean is adding a plan-wide list that admins can modify (ideally it would be one list per type of resource, but that's reaching…) to include domains (in subdomain.domain.tld format) where authentication is allowed/same-site-origin restrictions are relaxed.
The scenario I am thinking of is SharePoint and embedding resources in a SharePoint site in an environment where the Smartsheet settings are restricted for all resource types to "users on the same plan/owner's account" to prevent data exfiltration.
Currently we can sort of do this for forms and dashboards, although we have to authentication to Smartsheet first in the same browsing session, and then load the page with the embedded resource on it), via their publish feature. Other Smartsheet resources like Sheets, Reports, or Calendars don't seem to have even this option.
It would be very useful if all resource types had this Publish option (note: just read-only is really needed/doable for something like this, obviously), but moreso it would be great if we could selectively publish any resource type to a list of whitelisted domains so that, for those domains, we don't have to require logins to view content.
The end result being I could add a domain to my plan's whitelist (e.g. contoso.sharepoint.com, then publish a sheet or other resource, selecting the option to share with users in my plan or on whitelisted domains, and then throw that sheet's Publish URL into an iframe on a SharePoint site, and anyone with access to that SharePoint page could load a view-only version of that resource, without having to login, and without that resource being fully public on the internet to anyone with the URL.
