> For the complete documentation index, see [llms.txt](https://docs.docontrol.io/docontrol-user-guide/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://docs.docontrol.io/docontrol-user-guide/risk-management/threat-model-coverage/external-collaborator-sharing.md). # External collaborator sharing **SaaS security problem** Files stored in SaaS applications retain their sharing permissions indefinitely. External collaborators, including third-party vendors, retain access to sensitive documents, and old sharing links remain active unless permissions are manually changed. Even IDP solutions cannot remove data access permissions from all SaaS files, meaning access to this information often remains long after it is needed. This is not only bad business practice, but it significantly increases the amount of sensitive data vulnerable to exfiltration by malicious actors. **DoControl solution** DoControl allows you to limit external sharing by approaching SaaS data permissioning from a position of least privilege. You can remove access when assets are no longer needed by the parties with whom they were shared. This helps to minimize data overexposure, and mitigate the risk of data loss. DoControl leverages these tools to automatically monitor, mitigate, and remediate the risks associated with external collaborator sharing across a variety of apps: * [Inventory](#docontrol-inventory-of-external-collaborators) * [Events](#events-with-external-collaborators) * [Alerts](#alerts-for-external-collaborators) * [Playbooks](#playbooks-for-external-collaborators) ## Who's an external collaborator? External collaborators include external actors, such as partners, customers, services agencies, third-party vendors, and other parties not employed by your organization. ## What's the risk? Sharing assets externally means they are now accessible to specific users outside of the organization. While that might be OK in some cases, you need to be careful that internal or sensitive data is not exposed. Sharing a large number of assets externally in a short time span increases the risk of data overexposure and potential data loss. ## Inventory of external collaborators DoControl's rich inventory exposes external collaborators for assets, by indicting the sharing status for each asset (internal or external). From the Assets page, you can: * Filter assets per app for external collaborators * Remediate assets using[ inventory actions](/docontrol-user-guide/workflows/inventory-actions-quick-actions.md), such as removing external collaborators The External sharing status varies slightly across different SaaS apps:

External sharing in SaaS app	Description
Box	Asset is shared outside the organization.
Google Drive	Specific internal or external users with the link can access the asset, after authentication.
SharePoint, OneDrive, Teams	Anyone with the link can access the asset, after authentication.

{% hint style="success" %} DoControl indicates assets as **external** when they are shared with at least one external user. Based on data from Google API, DoControl can distinguish between internal and external users. {% endhint %} Filters for externally shared assets vary according to app:

SaaS app	Filter for externally shared assets
Box	Sharing status includes External
Google Drive	Sharing status includes External
OneDrive	Click the External assets icon
SharePoint	Click the External assets icon
Slack	Files > External channels equals True Channels > Shared externally equals Shared
Teams	Click the External assets icon

#### To filter and remediate assets that are shared externally: 1. In the Assets page, select the relevant SaaS app. 2. Filter for a **sharing status** that **includes** External, or any other external sharing filter.\ For example: Filter for externally shared Google Drive assets within a specific department.

3. Select one of more assets. 4. Click **Remediate > Inventory** **actions**, and select the relevant inventory action: * Remove external collaborators * Remove all collaborators
The external collaborators are removed from the assets. {% hint style="info" %} For more uses cases of filtering for external collaborators in specific apps, see [Assets](/docontrol-user-guide/saas-data-monitoring/inventory/inventory-assets.md). {% endhint %} ## Events with external collaborators DoControl monitors real-time events of external sharing. In the Events page you can apply a quick filter to display all events where assets were shared with external collaborators in the last 7 days:

#### To filter events for external collaborators: 1. From the DoControl side menu, click **Events**. 2. Select the **External sharing** quick filter. Each [event](/docontrol-user-guide/saas-data-monitoring/events.md) shows user and asset activity, the event type, and raw details in the JSON file. ## Alerts for external collaborators DoControl alerts automatically notify your organization when anomalous user behavior occurs. External sharing alerts indicate that excess permission privileges were granted to external users outside your organization.

Alert type	DoControl alert name	Alert description
DC3	External sharing of sensitive files	This alert will trigger when an internal user externally shares potentially sensitive files. A file is considered sensitive if its name includes one or more sensitive keywords, or a user-defined keyword was detected in the file name.

{% hint style="info" %} For details about DoControl alerts, go to **Help > DoControl Alert Specifications**. {% endhint %} ### How to remediate alerts? If you receive external sharing alerts, you can remove external sharing permissions from exposed assets by using the **Remove external collaborator** inventory action. It is also recommended to set up a workflow that will auto-expire sharing with external users and minimize risk over time. {% hint style="info" %} You can apply inventory actions to remove external collaborators from assets in these SaaS apps: * [Box](/docontrol-user-guide/workflows/inventory-actions-quick-actions/box-inventory-actions.md) * [Google Drive](/docontrol-user-guide/workflows/inventory-actions-quick-actions/google-drive-inventory-actions.md) * [OneDrive](/docontrol-user-guide/workflows/inventory-actions-quick-actions/onedrive-inventory-actions.md) * [SharePoint](/docontrol-user-guide/workflows/inventory-actions-quick-actions/sharepoint-inventory-actions.md) {% endhint %} ## Playbooks for external collaborators To address the use cases of external collaborator sharing across various SaaS apps, you can define automated workflows with DoControl's out-of-the-box playbooks. These playbooks will: * Notify your security team whenever an asset is shared with an external party (immediately or after a given time frame) * Automatically remove external collaborators * Automatically delete shared files that contain PII or sensitive information * Notify when external users are added to internal Teams channels

Select a predefined DoControl playbook to remediate external collaborator sharing

{% hint style="info" %} You can configure workflows that will auto-expire external sharing in specific SaaS apps. See the DoControl **demo videos** for [Google Drive ](https://youtu.be/x9ayyk05BjA)and [Box](https://youtu.be/TnJbsclIX_c) as a best practice to help minimize data overexposure, and mitigate the risk of data loss. {% endhint %}

Playbook name	SaaS app	Playbook description
Auto-expire external sharing	Box	When someone shares a file externally in Box, the actor is notified in Slack, and external collaborators are removed after 30 days.
Remove collaborators on-demand	Box	When a user triggers a DoControl inventory action to remove collaborators from Box, external collaborators are automatically removed from the asset.
Notify on external sharing	Dropbox	When someone shares externally in Dropbox, the security team is notified by Slack, Teams or webhook.
Auto-expire external sharing with private accounts	Google Drive	When someone shares with private accounts in Google Drive, notify the actor by email, wait 30 minutes, and then remove external collaborators who have private email domains.
Remediate external sharing with 3rd party vendors	Google Drive	When someone shares a file externally in Google Drive with at least one collaborator who is not in a trusted domain, and collaborators with private email domains are added, the collaborators are removed, and the actor is notified in Slack.
Notify when non-admin users move files outside the organization	Google Drive	When a non-admin user moves Google files to an external organization by changing the owner to an external user, the SecOps team is notified in Slack.
Remediate external over-exposure with a loop function	Google Drive	When someone shares a file externally in Google Drive and approval is not given, external collaborators who are not in trusted domains are removed. If approval is given, a 60-day grace period will elapse until sending the approval request again.
Remediate external sharing of PII	Google Drive	When someone shares a file externally in Google Drive, the file is scanned for PII labels: - If the probability of containing PII is high, remove external collaborators who are not in trusted domains, and notify the actor by email - If the probability of containing PII is medium, ask the actor to approve the external file sharing. If he doesn't approve, remove external collaborators who are not in a trusted domain. - If the probability of containing PII is not medium, wait 30 days and ask the actor to approve. If the file sharing is not approved, remove any external collaborators who are not in trusted domains.
Remediate external sharing of files having sensitive Google labels	Google Drive	When someone shares files externally in Google Drive with a sensitive Google label, such as "Restricted," the external collaborators from non-trusted domains are automatically removed from the assets, and the actor is notified in Slack. If the SecOps team approves the file sharing, the external collaborators are not removed.
Remediate external sharing if user has active alerts	Google Drive	When someone shares files with external collaborators in Google Drive, check if the actor has any active alerts. If yes, remove external sharing permissions until the alerts are handled.
Remediate external sharing of sensitive content	Google Drive	When someone shares an asset that contains sensitive content - data classifiers or regex patterns - externally in Google Drive, the actor is asked to approve the file sharing. If the sharing is not approved, the external collaborators are removed.
Remediate external sharing of sensitive Regex content	Google Drive	When someone shares an asset that contains a sensitive keyword externally in Google Drive, the security team is notified and external collaborators who are not in trusted domains are removed.
Remove collaborators from a specific domain on-demand	Google Drive	When a user triggers an on-demand, aggregated inventory action to remove external collaborators, who belong to a specific domain, from Google Drive assets.
Remove external collaborators and restore after approval	Google Drive	When someone shares a Google Drive asset with a private email, the external user permissions are instantly removed from the asset. If the file sharing is approved, for example by the SecOps team or the actor's manager, then the external user permissions are automatically restored, and the actor is notified in Slack that the sharing was approved.
Remove external collaborators on-demand	Google Drive	When a user triggers a DoControl inventory action to remove external collaborators from Google Drive, external collaborators are automatically removed from the asset.
Remove external sharing	Google Drive	When someone shares a file externally in Google Drive, the actor is notified by email, and any external collaborators who are not in trusted domains are removed.
Remove external sharing	OneDrive	When someone shares externally in OneDrive, the security team is notified in Slack, and external collaborators not in trusted domains are removed.
Remove internal and external collaborators on-demand	Google Drive	When a user triggers a DoControl inventory action to remove internal and external collaborators, all internal and external access permissions are automatically removed from selected My Drive assets.
Remove sharing on-demand	OneDrive	When a user triggers a DoControl inventory action to remove sharing from OneDrive, external collaborators are automatically removed.
Notify on external sharing	OneDrive	When someone shares externally in OneDrive with someone not from a trusted domain, the security team is notified in Slack.
Notify on external sharing	SharePoint	When someone shares externally in SharePoint with someone not from a trusted domain, the security team is notified in Slack.
Remove sharing on-demand	SharePoint	When a user triggers a DoControl inventory action to remove sharing from SharePoint, the external collaborators are automatically removed.
Remove external sharing	SharePoint	When someone shares externally in SharePoint with someone not from a trusted domain, the security team is notified in Slack, and external collaborators are removed.
Auto-delete files in externally shared channels	Slack	When someone uploads a file containing sensitive keywords to an external Slack channel, the security team and actor are notified, and the file is deleted.
Remediate PII sharing in external channels	Slack	When someone shares a file with an external Slack channel and the file contains PII (personally identifiable information), the file is deleted.
Remove PII from Slack Enterprise shared channels	Slack Enterprise	When someone shares a message or file in a shared Slack Enterprise channel containing PII (personally identifiable information), the message and file are quarantined in near real-time for further analysis. If approved, the message and file are restored. If not approved, both the message and file are deleted.
Notify when external users are added to internal Teams channels	Teams	If an external user is added to an internal company channel, the Security Ops team is notified by both email and a Teams message.

--- # Agent Instructions This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com. ## Querying This Documentation If you need additional information that is not directly available in this page, you can query the documentation by asking a question. Perform an HTTP GET request on the following URL with the `ask` and `goal` query parameters: ``` GET https://docs.docontrol.io/docontrol-user-guide/risk-management/threat-model-coverage/external-collaborator-sharing.md?ask=&goal= ``` `ask` is the immediate question: it should be specific, self-contained, and written in natural language. `goal` is what the user is ultimately trying to achieve, the reason they need the answer. Sharing it helps GitBook give you a better, more relevant answer. A goal is most helpful when it describes the outcome the user wants rather than restating the question. For example, with `ask=how do I create an API token`, a goal like `automate deployments from our CI pipeline` lets GitBook tailor the answer to that use case. The response will contain a direct answer to the question and relevant excerpts and sources from the documentation. Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.