4 ms·

Sharepoint is misery.

eitland 5y ago
I've given up on reporting it so here you get another for free: if you use the information protection feature in SharePoint, be sure to test it extremely carefully. We evaluated it for a project two years ago and what we luckily realized before putting it into production was that there was a simple and straightforward way for an end user to download unencrypted versions of all the files they had access to, and no way to prevent it that we or the local Microsoft team could find. (This was before the pandemic and might have been fixed now but it was so bad I figured it is worth mentioning. It was trivially easy once you know about it, something about how you logged in, but there was nothing to warn admins about it.)
- mcny 5y ago
  If I understand your scenario, it is pretty silly anyways and probably meant as a checkbox to tick for procurement to agree to purchase Office 365. It does not make sense to me to say I can view a document but not download it. If I can view a document, I can do screen capture. I think this used to be called the analog hole or something.
  - eitland 5y ago
    No, that's not what I'm talking about. To try to secure against the analog hole you have to increase background checks, only open documents in secure areas etc. What I'm talking about is a light way to secure documents that are sent with trustworthy technicians out in the field, to prevent against consequences from honest mistakes, not intentional spying. This worked pretty well in first tests and for the clients demands (but every company should make sure to verify it for their own requirements). What Microsoft tried to sell us on was that SharePoint should be able apply this lightweight protection automatically to these files.
    - GekkePrutser 5y ago
      > What I'm talking about is a light way to secure documents that are sent with trustworthy technicians out in the field, to prevent against consequences from honest mistakes, not intentional spying. Isn't this what Azure Information Protection is supposed to be?
      - eitland 5y ago
        Yep. And somehow SharePoint was supposed to apply either AIP or something similar automatically.

I've given up on reporting it so here you get another for free: if you use the information protection feature in SharePoint, be sure to test it extremely carefully. We evaluated it for a project two years ago and what we luckily realized before putting it into production was that there was a simple and straightforward way for an end user to download unencrypted versions of all the files they had access to, and no way to prevent it that we or the local Microsoft team could find. (This was before the pandemic and might have been fixed now but it was so bad I figured it is worth mentioning. It was trivially easy once you know about it, something about how you logged in, but there was nothing to warn admins about it.)

mcny 5y ago
If I understand your scenario, it is pretty silly anyways and probably meant as a checkbox to tick for procurement to agree to purchase Office 365. It does not make sense to me to say I can view a document but not download it. If I can view a document, I can do screen capture. I think this used to be called the analog hole or something.
- eitland 5y ago
  No, that's not what I'm talking about. To try to secure against the analog hole you have to increase background checks, only open documents in secure areas etc. What I'm talking about is a light way to secure documents that are sent with trustworthy technicians out in the field, to prevent against consequences from honest mistakes, not intentional spying. This worked pretty well in first tests and for the clients demands (but every company should make sure to verify it for their own requirements). What Microsoft tried to sell us on was that SharePoint should be able apply this lightweight protection automatically to these files.
  - GekkePrutser 5y ago
    > What I'm talking about is a light way to secure documents that are sent with trustworthy technicians out in the field, to prevent against consequences from honest mistakes, not intentional spying. Isn't this what Azure Information Protection is supposed to be?
    - eitland 5y ago
      Yep. And somehow SharePoint was supposed to apply either AIP or something similar automatically.