Admin Access to Everything?

Teresa Sabino

Is there a way that a Smartsheet Administrator would be able to gain access to all sheets/workspaces, even if not specifically shared to the admin?  I am asking in terms of access controls, so we can put a control in place where the admin ensures no PI or Confidential informaiton is being added.  Thanks!

Joy Durham

We have a "banner" on our page that says "Smartsheet is not approved for PHI".  It's on every sheet we create, so there's not question about it.

Richard Rymill SBP

Teresa

What Joy does is really simple and sensible, making it everyone's responsibility to comply. 

To add further monitoring controls to MAKE SURE everyone complies, you can download the Sheet access report for everything in your Smartsheet account via the Admin screens, which tells you what everyone has in use and who shares what with whom, plus you have the ultimate control, which, as administrator allows  take control of everything owned or shared by any of your users and re assign ownership to a) you or b) a replacement person. Normally used to deny access to departing colleagues but.... if needs must? 

Another suggestion is this.... the new Activity log, present at the bottom of your sheet screen for Business users, allows you to easily monitor who is doing what in any sheet and using the filter option you can monitor any person who concerns you. 

You could mandate that all existing and New Workspaces automatically include YOU the Admin, as an Admin so you can "Help out when they need it" but also confirm Compliance. 

Typically, once workers know they are being monitored, the issues goes away very quickly. 

 

Hope that helps, RichardR 

 

J. Craig Williams

Teresa,

The answers above describe solutions.

The answer to your question is "yes the Smartsheet administrator can access the data without being shared to the sheet." By Smartsheet administrator, this is anyone designated as a SysAdmin by the account owner, not an Admin of a sheet or workspace.

I won't post how.

Craig

 

Susan Peck

This issue has been a long-standing concern of ours.  We have used Smartsheet since 2011, before the Licensed User concept existed.   At that time, we had one Creator and several collaborators.  As we've grown and Smartsheet has changed, we now have six licensed users and are adding collaborators (all employees) daily.  

We've requested the "super-sys admin" feature many times so one person can see the whole scope of our Smartsheet implementation.  The responses have gone nowhere, yet we also haven't received a compelling explanation why such a user designation would not exist (it exists on every company's network).  Maybe one of you can explain why?

Craig, I can understand why you don't want to provide the "how to," but it gives me hope to figure out how to do it.  

Simply asking people to share their sheets with the Sys Admin is a good idea, but not infallible.  Checking up by reviewing Sheet Access is also an option, but time consuming.  We are still at a Team level.  Maybe I need to push the bean counters to upgrade to Business level to have the Activity Log?  Would that simplify our ability to keep track of what's happening with Smartsheet?

Thanks for any insights!  Even though we've used Smartsheet for 6+ years, we are only know tapping into the Community.  I've learned a ton already!

susan

Brad Jones

The suggestions of Joy and Richard are sound, but they are not so much solutions as they are 'work-arounds'.

They rely too much upon trusting every user to do the right thing - or depend upon you monitoring for unwanted changes.

The real SOLUTION is to have a controls system in place that prevents the problems from happening in the first place, rather than simply making a quite note somewhere in the background that something bad has happened.  There should be a solution available that allows for you to grant some users the ability to manage users and groups without giving them the ability to completely 'steal' the entire account.

I'm all for the "Super Admin" level of user as well.  

This is something that should be fixed immediately, because even though one person may act as the "Smartsheet System Owner" for your company, and they may actually own 95% of the sheets in the account, it is a relatively simple thing for any other SysAdmin in the company to take away all their sheets/workspaces, remove all of their permissions, and delete them from the account.

 

 

J. Craig Williams

Just like certain operating system (cough-Linux-cough) or IT system, anyone with the keys to the system needs to be trusted. If they aren't don't give them the keys.

I recommend to my clients that there needs to be TWO SysAdmin. Very often no less. Since you can't compartmentalize them, a SysAdmin in finance can potentially see the data in operations and the reverse is true.

I don't believe the Activity Log in its current incarnation will provide the oversight you are looking for.

Craig

TanyaC

Can you let us know how to access workspaces as a sysadmin even if we have not been shared to the workspace?

I want to be able to assess what is being used in each workspace to try and standardize templates across our organizational and I need to see what everyone is using or creating. 

Richard Rymill SBP

Tanya

The simplest answer is to ask all your workspace owners to include the sys admin in their share list. 

To check they are complying you can download an excel sheet listing all each persons activity in your control panel. 

That said our API team are working on a "Global Audit" tool or as we call this "Smarter permissions explorer" which i believe will address your needs? Available in June 2019. 

Happy to discuss this offline if you wish? To be transparent... there is a cost for our API solutions if they are needed, while our team do our best to provide free community advice where we can, as above. 

Richardr

Lead Consultant. SmarterBusinessprocesses.com