Document library OneDrive sync security

[Daniel Mare]

We have a document library in SharePoint online which will contain confidential information.

How can we reduce security risks?

For starters, MFA is enforced for all users that have access to this document library.

My biggest concern, however, is the entire document library getting synced to a laptop and that laptop getting stolen.  Files-on-demand greatly reduces this risk: only the documents that were worked on by that employee would be downloaded to the hard disk.  This may be an acceptable risk, but is there a way we can force the document library to be set to "Online-only files" and prevent them from setting the entire document library to "Always keep on this device"?

One safer alternative to OneDrive app sync would be to Map a network drive to a SharePoint library, that way, they see it in Windows File Explorer as if it's a file share, but the information is never copied to their local machine, however, Microsoft says: "this is legacy technology and it may be affected by the deprecation of Internet Explorer in August 2021".  What would be the equivalent alternative?

I understand there are pretty good controls over OneDrive with group policy, however, some of our Windows computers that will be using these document libraries are not joined to AD.

I understand "Search and offline availability" can be disabled, but users want to be able to access the documents through Windows File Explorer, and not via the web interface.  Users also need to work directly on spreadsheets using their local Excel app installations, not limited online Excel.   Is it possible to use locally installed Excel on Windows to edit spreadsheets in a document library when "search and offline availability" is disabled?

Any recommendations of how to best secure document libraries when a requirement is for users to access the files through Windows File explorer?

[#2]

@Daniel Mare 

This is an area not many folks are concerned about but they should be. Good to see you are aware of this.

• "Files On-demand" is not a robust solution. Users can simply modify the settings on the their computer.
• Using "Storage Sense" to limit the availability of local content (e.g. automatically remove the local version after 1 day inactivity) is also not a solution: users can also simply change these local settings.
• Map network drive: this is major source for incidents tickets and the blocking of IE11 to access Office 365 as of 17 August 2021 will not help.
• I would consider InTune but that will not work (AFAIK) if the computers are not joined to your AD domain. It may also require additional licenses.
• Disabling offline capability per library or per site may help. This reduces the risk but there is still the option to download all content. Plus it negatively affects functionality available to your users.
• Use browser-based tools that work like File Explorer. See e.g. https://www.slimapplications.com/wp-content/uploads/2020/12/ExplorerEditInAppOffice.png
  The "Edit in App" allows users to edit Office files using the local Office app and changes are automatically saved to SharePoint. i.e. no need to have offline content.
• Use sensitivity labels and encryption. This requires proper planning, possibly additional licenses and training users (probably also outside your company).

Summary: this is not an easy problem to fix.

Paul | SLIM Applications

[#3]

Thanks for your advice @Paul_HK_de_Jong 

I think we will have to joined those laptops that need access to an AD domain and then use OneDrive sync domain restriction: https://docs.microsoft.com/en-us/onedrive/allow-syncing-only-on-specific-domains, plus the many group policy options to secure it.

[#4]

@Daniel Mare 

This is the exact issue I am in right now, as we migrate to Sharepoint and more WFH applications.  I know this about a year old.  Did you find a solution that works for you ?