View and manage cloud storage file sharing permissions

Overview

The Code42 Box, Google Drive, and Microsoft OneDrive data connections help you identify when a file in those cloud storage environments has been shared with others. When users take risky actions like sharing a file publicly, you can view those sharing permissions to determine how best to resolve unsafe sharing. If you have the correct permissions in Incydr, you can also revoke a file's sharing permissions to secure important data.

Considerations

• You can view and manage sharing permissions only for files in Box, Google Drive, or OneDrive cloud storage environments that are monitored by a Code42 data connection.

• For OneDrive and Google Drive, viewing and managing file sharing permissions requires additional OneDrive permissions or Google Drive scopes. To add these new permissions or scopes to these data connections if they don't already exist, deauthorize and resume monitoring the data connection.

• The data connection's status must be Monitoring in order for you to view and manage its files' sharing permissions.

• To use this functionality, Incydr users must be assigned specific roles. For more information, see Permissions for Incydr. 

View and revoke a cloud storage file's sharing permissions

1. Sign in to the Code42 console.
2. Locate the cloud storage sharing event for the file.
   You can access information about file events from many places, such as Forensic Search, Cases, Alerts, the All Users list, and the Risk Exposure dashboard.
3. Open the event details for that file.
4. In the Share type row under Event, click either View sharing or View and manage sharing.
   The label on the button varies depending on your permissions in Incydr.
   
   When you click the button, Code42 opens a new tab, requests that file's list of sharing permissions from the cloud storage vendor, and then displays that list in the new tab. If any errors occur, the tab lists the cause of the error and how to resolve it.
5. If you have the Insider Risk Admin or Insider Risk Respond role, you can revoke a file's sharing permissions to untrusted or unauthorized users. When you revoke specific sharing permissions, those users lose their access to that file. Select the checkboxes next to the permissions and then click Revoke.
   • You cannot revoke permissions for file owners.
   • Because cloud storage environments often have several methods to share files, a single user may have multiple sharing permissions and can be listed more than once. Select the checkbox next to each entry to fully remove that user's sharing permissions.
   • If any errors occur, the tab lists the permissions that were successfully revoked along with those that failed. For those that failed, try to revoke them again later. See also Troubleshoot errors below for more information.
     

Troubleshoot errors

If your request to view or revoke a cloud storage file's sharing permissions fails, see below for ways to resolve the issue.

Related topics

• File event metadata reference 
• Cloud storage data connections overview 
• Data Connections reference