When configuring your Policies in ProvisionPoint Rules need to be added to ruleset groups. This article will explain what External Sharing mismatch is and list the rules that are available.
What is External Sharing?
The external sharing features of SharePoint Online allows users in your organisation to share content with people outside the organisation (such as partners, vendors, clients, or customers).
Expand to learn more..
External sharing settings can be configured at organisation or Site level in your Microsoft tenant.
The organisation level can be configured in SharePoint Admin Centre > Policies > Sharing, once a Site is created the SharePoint Admins can then change the Site Level by accessing the policies in the Site Property.
ProvisionPoint allows the site level to be set on provisioning or via manual action changes.
When you try to share documents or lists and the settings do not allow it, an error will be displayed:
What is External Sharing Mismatch?
When provisioning through our app the organisation level can be used or we can allow the requestors to choose what the site level permission will be.
Once the workspace is created the Sharing options may get changed, this could happen for many reasons.
If you want to ensure that the External sharing is set as expected, use the Compliance policy rules to
- Look for sharing setup that is not supported.
- Define the mismatch value to look for and let the scheduled policy show you the results
- Notify owners, admins or others that there is non-compliance
- Make a change using the Align rules.
You can also ensure any changes made in O365 are applied to ProvisionPoint instances or vice versa.
Available rules:
|
Rule name
|
Description
|
|
Eternal Sharing Mismatch - Report
|
Report only on the mismatch that is configured
|
|
External Sharing Mismatch - Notify
| Send an email to configured people about the non-compliance, this email will include content define in the rule. Additional configuration will be needed, read the Configure Notifications for Notify Rules article for more information |
|
External Sharing Mismatch - Align
| Align to M365, ProvisionPoint instance, a defined value and more |
We always recommend starting with a Report rule to ensure the policy brings back the results you expect before applying the action rules (Align)
Mismatch Types
The mismatch you choose will set what is going to be flagged as non-compliant.
| Mismatch Type | Description |
| Instances | The M365 workspace does not match the service instance shown in ProvisionPoint Directory info |
| Service Definition default | The M365 workspace or the service instance do not match the service definition default |
|
Service Definition Override
|
The M365 workspace or the service instance do not match the service definition override values
|
|
Transform Tag
|
The M365 workspace or service instance do not match a transform tag value. A transform tag would be defined in a lookup or as a request variable in ProvisionPoint. This value would be used to set the Privacy setting at provisioning.
Add the name of the request variable or lookup to the Mismatch value
|
| Defined values | The M365 workspace or service instance do not match any of the selected values set to Yes |
Align Types
If non-compliance is found the align type will set what changes will be applied.
| Align Type | Description |
| O365 workspace | Will set service instance to match the M365 setting |
| Service Definition default | Will set the M365 workspace and the service instance to match the service definition default |
| Service Instance | Will set the M365 workspace to match the service instance setting shown in Info |
| Defined values | Will set the M365 workspace and service instance to match the Align value |
| Min value | Will set the least permissive value from the M365 workspace or service instance. |
| Max value | Will set the most permissive value from the M365 workspace or service instance |
| Transform Tag | Will set the M365 and service instance to match the value set by the transform tag set in Align value. This will be the name of the request variable or lookup. |
Check the Results:
Once a Compliance policy is run you can check the results in the Job Queue and in the Timeline if it is non-compliant.
Read the articles in the Job Queue section