Where are these externally shared files?

Hi GI472,

1. Does the MCAS file search find actual files that are current in our environment or does this show a historic series of snapshots?

The MCAS file search finds actual files that are current in your environment. It also shows a historic series of snapshots, but these snapshots are only shown for files that have been shared externally.

2. Why are recent joiners shown as collaborators on documents and folders for someone who left so long ago?

There are a few possible reasons why recent joiners are shown as collaborators on documents and folders for someone who left so long ago:

• The recent joiners may have been added as collaborators to the files by the previous owner.
• The recent joiners may have gained access to the files through a group or team that the previous owner was a member of.
• The recent joiners may have gained access to the files through a sharing link that was created by the previous owner.

3. How can I actually find the files the search tells me it found?

There are a few ways to find the files that the MCAS file search tells you it found:

• You can use the MCAS portal to filter the search results by file owner, collaborator, or other criteria.
• You can use the MCAS portal to export the search results to a CSV file.
• You can use the MCAS PowerShell module to search for files and export the results to a CSV file.

4. If I set up a governance action to remove external users from the file share, will this actually work?

Yes, setting up a governance action to remove external users from the file share will actually work. However, it is important to note that this action will only remove external users who have been added to the file share directly. It will not remove external users who have gained access to the file share through a group or team.

5. If I want to test, can I create an admin quarantine site/location on SharePoint and use the option to 'Put in admin quarantine'? If so, what will happen and what are the possible implications/ramifications?

Yes, you can create an admin quarantine site/location on SharePoint and use the option to 'Put in admin quarantine'. This will move the file to the quarantine site, where it will be held for a period of time before it is deleted.

The possible implications/ramifications of putting a file in admin quarantine are:

• Users will not be able to access the file while it is in quarantine.
• The file may be deleted after a period of time.
• The file may be restored to its original location if it is needed.

Recommendations

I recommend that you do the following:

1. Use the MCAS portal to filter the search results by file owner and collaborator. This will help you to identify the files that were shared by the now-left user.
2. Export the search results to a CSV file. This will give you a record of the files that were shared.
3. Use the MCAS PowerShell module to search for the files and export the results to a CSV file. This will give you a more detailed list of the files, including their location and permissions.
4. Review the list of files to identify any that are sensitive or that should not be shared externally.
5. Remove external users from the files that should not be shared externally.
6. Consider creating an admin quarantine site/location on SharePoint and using the option to 'Put in admin quarantine' on the files that you are unsure about.

You should also review your sharing policies to ensure that they are adequate and that they are being enforced.