365 Permissions: policies, assignment and rules

The four policies

Every location has exactly one of four policies. The default policy applies to every location without a policy of its own, including new ones.

• Public: allows “Anyone with the link” with view permission as well as shares with people outside and private mailboxes. For press kits, price lists, product sheets.
• Internal: allows shares with people outside. Not allowed are “Anyone with the link” links, private mailboxes and public teams. For most teams and projects; shipped as the default policy.
• Confidential: allows shares only with people who have a guest account. Links need an expiration date; every location needs two owners. For accounting, customer data, contracts.
• Strictly confidential: allows no sharing outside the organization and no people outside in teams. For HR and management.

Adjusting policies

The Policies tab shows for each policy, as questions and answers, what it allows, in five areas: Anyone with the link, People outside, Internal sharing with everyone, Ownership, Outdated access.

Anyone with manage permission changes a policy for their own organization by clicking a different answer, and for days and individual shares also the number. Adjust rules additionally lets you turn individual rules on and off for the default policy and enter trusted domains, for example a service provider's. People from a trusted domain produce no task for “Person outside as owner” and “Share with a person outside without a guest account”.

Before saving, a preview shows how many shares will not comply afterwards and how many before. The change applies to every location with this policy. An adjusted policy is marked “with adjustments” and can be reset with Restore the shipped version.

Assignment

The Assignment tab defines which location has which policy:

• per location, for example Strictly confidential for HR,
• by name, for example every location whose name starts with “Project”, including future ones,
• OneDrives by group: the OneDrives of all members of a directory group, for example management,
• individual folders, if a folder should be stricter than its location.

A choice per location takes precedence over a rule by name. Before saving, each location shows how many shares will not comply afterwards, with today's state below.

The rules

Eighteen rules evaluate the inventory. Each rule has a fixed priority. The table shows which policy checks which rule in the shipped version.

Notes on individual rules:

• Person outside as owner: a person outside the organization who owns a location can do everything there, including deleting files and giving others access. A trusted domain is excluded, for example for the service provider who maintains the location. The rule always produces a task; Conbool never changes owners itself.
• Location without an owner, Only one owner, People outside in the team apply to teams and Microsoft 365 groups. They do not check security and distribution groups from the directory.
• Expired links produce no task and do not count as shares outside.
• Guest account unused for a long time applies only once the scan reads the guests' last sign-ins. Until then the rule produces no task.
• Link to a file from a Teams chat applies only once a deadline for such links is set in the area “Anyone with the link”.

Deadlines

A task's deadline counts from the day the share was first captured.

Without automatic clean-up, the deadline is informational. It blocks nothing and cleans up nothing on its own.