> For the complete documentation index, see [llms.txt](https://docs.docontrol.io/docontrol-user-guide/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://docs.docontrol.io/docontrol-user-guide/risk-management/posture/microsoft-app-posture.md). # Microsoft app posture Microsoft 365 tiles provide a snapshot of your organizational posture across all company departments using Microsoft 365 apps: OneDrive, SharePoint, Teams and Microsoft Entra ID. With DoControl's exposure analysis, you can focus on the main vulnerabilities and security risks in your organization. The terminology used in Microsoft 365 tiles is specific to Microsoft. ## Overview The Overview tile displays high-level metrics about Microsoft 365. It presents the total number of assets across all Microsoft 365 apps, internal and external users in Microsoft 365, as well as the total number of external domains that have access to assets in Microsoft 365.

The Microsoft 365 posture overview displays these parameters:

Overview parameter	Description
Connected	Indicates if your Microsoft 365 apps are connected to DoControl: OneDrive SharePoint Teams Microsoft Entra ID If an app is not indicated as connected, contact Customer Success.
Internal users	Number of users that belong to your organization and operate within the organization's domains.
External users	Number of users outside your organization with access to company assets, such as Microsoft 365 files.
External domains	Number of domains with external users who have access to assets in your organization.
Assets	Total number of Microsoft 365 assets, with distribution between OneDrive, SharePoint, and Teams assets.
All apps	Select All apps to display posture data for all Microsoft 365 apps, or select a specific app to display posture data only for that app: OneDrive SharePoint Teams

## Asset exposure This data shows how and where your organization's assets are exposed according to Microsoft 365 sharing statuses. Exposed assets are risky, since unintended people can access your company's sensitive data, leading to data exfiltration, compliance issues, and reputational damage. {% hint style="info" %} The metrics reflect the total number of **data exposures**, not the number of assets. The same asset can be exposed more than once. For the total number of assets, see [Assets](#overview) in the mini-dashboard. {% endhint %}

View the total number of public, external and internal exposures for your Microsoft apps. Asset exposure categories correspond to Microsoft 365 asset sharing statuses:

Exposure description	Microsoft 365 sharing status	File permission
Public assets open to the world	Public	Anyone with link
Assets shared with external collaborators	External	Specific people
Internally shared in org via link	Organization	People in your organization

{% hint style="success" %} Click on each asset exposure category to open the [Assets](/docontrol-user-guide/saas-data-monitoring/inventory/inventory-assets.md) page for a specific Microsoft 365 app, already filtered by the selected category. {% endhint %} #### To remediate asset exposure: 1. Select the total number of exposed assets for a specific app (OneDrive, SharePoint or Teams), OR 2. Select the number of exposed assets for a specific app (OneDrive, SharePoint or Teams), and for a specific sharing status. 3. Filter and select the relevant assets. 4. Click **Remediate** and select the relevant inventory action: * [Remove public sharing](/docontrol-user-guide/workflows/inventory-actions-quick-actions/onedrive-inventory-actions.md#remove-public-sharing) * [Remove external collaborators](/docontrol-user-guide/workflows/inventory-actions-quick-actions/onedrive-inventory-actions.md#remove-all-external-collaborators) * [Remove organization link](/docontrol-user-guide/workflows/inventory-actions-quick-actions/onedrive-inventory-actions.md#remove-organization-link) ## Top exposed sites Discover which sites have the most externally and publicly shared assets in your Microsoft 365 apps. The highest number of exposed sites is shown separately for OneDrive, SharePoint and Teams sites. This tile helps to direct attention to exposed areas in your organization. {% hint style="success" %} Tip: In many cases, most external sharing is done from a small number of Microsoft sites. {% endhint %}

#### To remediate exposed sites: 1. Click an app site to open the relevant Microsoft 365 **Assets** page, filtered to display only externally and publicly shared assets for that specific site, OR 2. Click the **View all**

icon to view all assets for a specific Microsoft 365 app: * VIew all OneDrive * View all SharePoint * View all Teams 3. Use the filters or select specific sites that are publicly or externally exposed. 4. Select specific OneDrive or SharePoint assets, and remediate with the [Remove public sharing](/docontrol-user-guide/workflows/inventory-actions-quick-actions/onedrive-inventory-actions.md#remove-public-sharing) or [Remove external collaborators](/docontrol-user-guide/workflows/inventory-actions-quick-actions/onedrive-inventory-actions.md#remove-all-external-collaborators) inventory action. ## Recent triggering events This tile displays the number of workflows and alerts involving Microsoft 365 apps that were triggered by a specific actor over the last 30 days.

#### To view recent triggering events: 1. Click the **Workflows** icon next to a specific actor's name.\ The [workflows triggered](/docontrol-user-guide/saas-data-monitoring/events.md#triggered-entities) for this actor are displayed with the date and time when they were executed.

2. Click the **Alerts** icon next to a specific actor's name.\ The alerts triggered for this actor are displayed with the date and time when they were generated, and the alert severity. 3. Alternatively, click the **View all**

icon to view all filtered [events](/docontrol-user-guide/saas-data-monitoring/events.md) for Microsoft 365 apps over the last 30 days. ## Alert status The Alert status tile summarizes alert insights from anomalous activities, including the total number of active alerts (new or in-progress), and details of recent alerts for all Microsoft 365 apps. You can drill down into each alert parameter and investigate further.

DoControl displays these alert parameters in the posture page:

Alert parameter	Description
Total active alerts	The number of active alerts (new or in-progress) with the increase or decrease compared to the last 30 days
Severity	The number of alerts according to severity level (high, medium, low)
Recent Microsoft 365 alerts	A list of alerts that was recently generated, including the severity level, specific app, date the alert was generated, and team member who's assigned to the alert
View all	Opens the Alert page filtered to display only alerts for Microsoft 365 apps: OneDrive, SharePoint, and Teams

## Remediation actions This tile shows how many remediation actions were performed over the last 30 days per app for all your OneDrive, SharePoint, and Microsoft Entra ID assets.

{% hint style="success" %} Click **View all**

to open the [Workflow list](/docontrol-user-guide/workflows/workflow-dashboard.md#workflow-list) displaying all **active** filtered workflows for Microsoft 365 apps: OneDrive, SharePoint, Teams, and Microsoft Entra ID. {% endhint %} You can perform these remediation actions on Microsoft 365 assets:

Remediation action	Description
Remove collaborator	Remove sharing permission for a specific collaborator
Remove sharing links	Remove public or organization sharing links from a file
Remove OAuth app	Delete an OAuth app from Microsoft Entra ID

## Workflow activity You can see the number of workflows involving Microsoft apps that have been triggered over the last 30 days. This helps to gain insights into potentially problematic user behavior. Each graph represents the number of active workflows according to a specific status: Completed, In-progress, Warning and Failed. For full execution details, see the workflow's [execution details](/docontrol-user-guide/workflows/activity-dashboard.md). {% hint style="success" %} Click **View all**

to open the [Workflow list](/docontrol-user-guide/workflows/workflow-dashboard.md#workflow-list) displaying all filtered workflows for Microsoft 365 apps: OneDrive, SharePoint, Teams, and Microsoft Entra ID. {% endhint %}

## Top sites with shared organization links Discover which Microsoft 365 sites have the highest number of exposed assets within your organization, according to specific app: OneDrive, SharePoint, and Teams. These assets are internally shared, and indicated with the "People in your organization" sharing link.

#### To remediate sites with shared organization links: 1. Click an app site to open the relevant Microsoft 365 Assets page, filtered to display only assets shared within the organization for that specific site, OR 2. Click **View all**

to view all assets shared for a specific Microsoft 365 app: * VIew all OneDrive * View all SharePoint * View all Teams\ \ The Assets page displays the specific app's assets sorted by the highest number of **organization** assets. 3. Select specific OneDrive or SharePoint assets, and remediate with the [Remove organization link ](/docontrol-user-guide/workflows/inventory-actions-quick-actions/sharepoint-inventory-actions.md#remove-organization-link)inventory action. ## Top exposed external users You can discover which users outside your organization have the most access to data in your organization.

#### To remediate exposed external users: 1. Click an external user to view all assets externally shared with the user in a specific Microsoft 365 app, OR 2. Click **View all**

to view the most exposed external users for a specific Microsoft 365 app: * VIew all OneDrive * View all SharePoint * View all Teams 3. Select specific OneDrive or SharePoint assets, and remediate with the [Remove all external collaborators](/docontrol-user-guide/workflows/inventory-actions-quick-actions/sharepoint-inventory-actions.md#remove-all-external-collaborators) inventory action.\ These assets are externally shared, and indicated with the "Specific people" sharing link. ## Top exposed domains You can discover which external domains have access to the highest number of assets in your organization.

#### To remediate exposed domains: 1. Click an external domain to view all external users with access to assets in a specific Microsoft 365 app. 2. Select specific OneDrive or SharePoint assets, and remediate with the [Remove all external collaborators](/docontrol-user-guide/workflows/inventory-actions-quick-actions/sharepoint-inventory-actions.md#remove-all-external-collaborators) or [Remove public sharing](/docontrol-user-guide/workflows/inventory-actions-quick-actions/sharepoint-inventory-actions.md#remove-public-sharing) inventory action. 3. Alternatively, click **View all**

to view all external domains that are sorted according to the highest number of total collaborations. {% hint style="info" %} Total collaborations is the number of external shares on all assets within a specific domain. For example: * Asset A is shared with and * Asset B is shared with and The total number of collaborations is 4. {% endhint %} ## Sites with encryption keys and certificates Discover the number of encryption keys and certificates stored in Microsoft 365 sites. Leaving accessible files increases the risk of data exfiltration, since these keys can be potentially used to access sensitive data in your organization.

#### To remediate the risk of insecure encryption keys: 1. Click the relevant Microsoft 365 site.\ The site opens in Microsoft 365. 2. Move the assets to an appropriate location or remove them altogether from OneDrive or SharePoint. --- # Agent Instructions This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com. ## Querying This Documentation If you need additional information that is not directly available in this page, you can query the documentation by asking a question. Perform an HTTP GET request on the following URL with the `ask` and `goal` query parameters: ``` GET https://docs.docontrol.io/docontrol-user-guide/risk-management/posture/microsoft-app-posture.md?ask=&goal= ``` `ask` is the immediate question: it should be specific, self-contained, and written in natural language. `goal` is what the user is ultimately trying to achieve, the reason they need the answer. Sharing it helps GitBook give you a better, more relevant answer. A goal is most helpful when it describes the outcome the user wants rather than restating the question. For example, with `ask=how do I create an API token`, a goal like `automate deployments from our CI pipeline` lets GitBook tailor the answer to that use case. The response will contain a direct answer to the question and relevant excerpts and sources from the documentation. Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.