Microsoft SharePoint and OneDrive

The migration is the easy part and it is the part everybody plans for. Files move, staff adjust, and the file server is decommissioned. The governance that the old file server provided by accident, chiefly that sharing outside the organization was difficult, does not move with it.

In its place is a system designed to make sharing simple. That is a genuine improvement in how people work and a genuine change in exposure, and the second half is rarely addressed with the same energy as the first.

Permission inheritance is the usual culprit. A folder inherits from its site, somebody breaks that inheritance to give one person access to one document, and from that point the two diverge. Repeat across several years and the effective permissions on a given file bear little relation to what anybody intended.

Sharing links compound it. A link created to send a document to a client may be set to work for anybody who has it, with no expiry. That link continues working after the project, after the client relationship ends, and after the employee who created it has left.

Neither of these is visible in normal use. A file looks the same whether four people or four hundred can open it, which is precisely why the problem grows unobserved.

Start with external sharing settings at tenant level: whether links may be created for anybody who has them, whether they expire, and whether staff may share with external addresses at all. This single set of choices removes most of the ongoing exposure.

Next, report on what already exists. Existing anonymous links are the accumulated risk, and most organizations have never listed them. The list is usually longer than expected and frequently includes material nobody would knowingly publish.

Then set retention. Content in SharePoint is now the organization's record, and how long it is kept should be a decision rather than an accident. Sensitivity labels follow, so that protection travels with a document rather than depending on where it happens to sit.

Finally, backup. The recycle bin and version history cover accidental deletion for a limited period. They are not a backup, and a retention policy that removed something is not recoverable from them.

For any organization past its migration, the sequence above is worth running once properly and then reviewing annually. Most of it costs nothing beyond the time to decide, which makes it unusually good value against almost anything else on a security roadmap.

Where a regulatory retention obligation exists, or where client contracts specify how material must be handled, the labelling and retention work stops being optional and should be scoped deliberately rather than approximated.