365 Permissions: tasks, exceptions and clean-up

Tasks

The Tasks page collects everything that needs a decision.

• Open: one row per rule and location, most urgent first, with priority, reason and deadline. A click shows the individual shares with item, recipient and permission.
• Awaiting approval: clean-ups with a preview that nobody has approved yet or that have not been executed yet.
• Exceptions: shares deliberately kept, with reason and end date.
• Done: executed and rejected clean-ups.
• Owner review: see below.

Every open row has two buttons.

• Allow exception records a share that should remain, with reason and end date. The reason appears in the report. When the end date passes, the task is open again. An exception applies to a single share or to all shares of the row.
• Clean up opens the preview without leaving the page.

What a clean-up can do

A clean-up changes shares in Microsoft 365 and needs the permission “Allow clean-up”. Possible actions:

• delete “Anyone with the link” links or give them an expiration date,
• remove shares with private mailboxes, with people outside without a guest account, with all employees or with deleted accounts,
• change shares with people outside without a guest account to view only,
• set an expiration date on links to files from Teams chats and on links for everyone in the organization in confidential locations,
• align a location's sharing setting with the policy.

Missing owners and owners outside the organization always remain a task; Conbool never changes owners itself. A deleted link cannot be restored with the same address.

How a clean-up runs

1. Preview: the page shows for each share what would happen. Nothing has changed.
2. Request approval.
3. Approval: a second person with the role Owner or Security officer approves. The requester cannot approve their own request.
4. Execution: every entry ends with a result: done, no longer present or failed.

For organizations with only one administrator, Without a second person can be chosen under Settings → Approval. The clean-up then runs directly after the preview. Preview and history remain.

Automatic clean-up

The Clean-up tab on the Policies page defines what happens to shares that do not comply with the policy:

• Show only: every such share becomes a task. Nothing changes automatically in Microsoft 365.
• Clean up partly automatically: you choose which kinds Conbool cleans up itself. All others become tasks.
• Clean up fully automatically: Conbool cleans up every kind that has a clean-up once its deadline has passed.

Automatic clean-up covers shares created after it was switched on, once their deadline has passed. Existing shares are cleaned up once with a separate action for the existing inventory. Every kind needs a second person's approval before it starts.

Owner review

Owners of teams, SharePoint sites and OneDrives receive an email with a personal link and decide for each share between Keep and Remove. Administrators must approve every removal. Scope, deadline, reminder and cycle of the review are configurable. Owners need no Conbool account for this.