> For the complete documentation index, see [llms.txt](https://docs.docontrol.io/docontrol-user-guide/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://docs.docontrol.io/docontrol-user-guide/risk-management/threat-model-coverage/internal-collaborator-sharing.md). # Internal collaborator sharing **SaaS security problem** Internal collaboration is considered standard practice. By working together in cross-department teams, organizations benefit from collaborative product development, increased sales through cross-selling, and sharing of best practices that reduce costs. However, cross-team collaboration significantly increases the volume of sensitive data vulnerable to exfiltration. When excess permission privileges are granted to cross-team users within your organization, then unauthorized access to sensitive data poses a real risk. In addition, access often remains long after it is needed. Files stored in SaaS applications retain their sharing permissions indefinitely. This is not only bad business practice, but significantly increases the volume of sensitive data vulnerable to exfiltration when insider threats or weak access controls prevail. **DoControl solution** DoControl allows you to limit internal sharing by approaching SaaS data permissioning from a position of least privilege. You can regularly review and update permissions, and remove access when assets are no longer needed by the parties with whom they were shared. This helps to minimize data overexposure, and mitigate the risk of data loss. To protect data integrity and maintain a secure environment for collaboration within SaaS platforms, DoControl leverages these tools to automatically monitor, mitigate, and remediate the risks associated with internal collaborator sharing: * [Inventory](#inventory-of-internal-collaborators) * [Playbooks](#playbooks-for-internal-collaborator-sharing) ## Who's an internal collaborator? An internal collaborator is anyone working for your organization as a salaried or freelance employee with access to your organizational SaaS data. ## What's the risk? Internal collaboration involves sharing confidential information across your organization's internal SaaS platforms. Weak access controls and legacy permission systems open the door for insider threat. Malicious actors with access to company assets can easily exfiltrate sensitive data, and cause significant damage to your organization. ## Inventory of internal collaborators DoControl's rich inventory exposes internal collaborators for assets, by indicting the sharing status for each asset (internal or external). From the Assets page, you can: * Filter assets per app for internal collaborators * Remediate assets using [inventory actions](/docontrol-user-guide/workflows/inventory-actions-quick-actions.md), such as change owner or remove collaborators Filters for internally shared assets vary according to app:

SaaS app	Filter for internally shared assets
Box	Sharing status includes: People in your company - Anyone in your organization with a Box account can access this asset Internal
GitHub	Visibility includes: Private Internal Private template
Google Drive	Sharing status includes: Internal Internal with link
OneDrive	Click an icon that indicates the asset's sharing status: Organization assets Internal assets
Salesforce	Sharing privacy includes Private
SharePoint	Click an icon that indicates the asset's sharing status: Organization assets Internal assets
Slack	Channel type includes Private
Teams	Click an icon that indicates the asset's sharing status: Organization assets Internal assets
Zoom	Sharing status includes Internal

#### To filter and remediate assets that are shared internally: 1. In the Assets page, select the relevant SaaS app. 2. Filter for a **sharing status** that includes **Internal**, or any other internal sharing filter, such as **Internal with link**.\ For example: Filter for Google Drive assets within a specific department that are shared with an internal link.

3. Select one of more assets. 4. Click **Remediate > Inventory actions**, and select the relevant inventory action: * Remove internal collaborators * Remove specific collaborators * Remove all collaborators * Change owner {% hint style="info" %} Google Drive assets: Inventory actions are supported only for Google Drive assets shared externally or publicly, or assets located in personal drives (My Drive). {% endhint %} ## Playbooks for internal collaborator sharing To address the use cases of internal collaborator sharing across various SaaS apps, you can define automated workflows with DoControl's out-of-the-box playbooks. These playbooks will: * Automatically remove collaborators who are not in a specific team in your organization * Remove organization links from shared OneDrive and SharePoint assets

Select a predefined DoControl playbook to remediate internal collaborator sharing

Playbook name	SaaS app	Playbook description
Remove cross-team collaboration	Google Drive	When someone shares a file in Google Drive with other team members, the actor is notified by email, and any collaborators who are not in a specific group are removed.
Auto-expire cross-team collaboration	Google Drive	When someone shares a file in Google Drive with other team members, the actor is notified by email, and after a waiting period, any collaborators who are not in a specific group are removed.
Remove internal collaborators on-demand	Google Drive	When a user triggers a DoControl inventory action to remove internal collaborators, all internal access permissions are automatically removed from selected My Drive assets.
Remove internal and external collaborators on-demand	Google Drive	When a user triggers a DoControl inventory action to remove internal and external collaborators, all internal and external access permissions are automatically removed from selected My Drive assets.
Remove org-wide sharing link on-demand	Google Drive	When a user triggers a DoControl inventory action to remove the company sharing link, the link is automatically removed from selected Google Drive assets.
Remove organization link on-demand	OneDrive	When a user triggers a DoControl inventory action to remove an organization link in OneDrive, the link is automatically removed.
Remediate ethical wall violations	SharePoint	When a user shares a sensitive file containing PII (personally identifiable information) with a user outside their SharePoint group, external collaborators are removed.
Remove organization link on-demand	SharePoint	When a user triggers a DoControl inventory action to remove an organization link in SharePoint, the link is automatically removed.

--- # Agent Instructions This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com. ## Querying This Documentation If you need additional information that is not directly available in this page, you can query the documentation by asking a question. Perform an HTTP GET request on the following URL with the `ask` and `goal` query parameters: ``` GET https://docs.docontrol.io/docontrol-user-guide/risk-management/threat-model-coverage/internal-collaborator-sharing.md?ask=&goal= ``` `ask` is the immediate question: it should be specific, self-contained, and written in natural language. `goal` is what the user is ultimately trying to achieve, the reason they need the answer. Sharing it helps GitBook give you a better, more relevant answer. A goal is most helpful when it describes the outcome the user wants rather than restating the question. For example, with `ask=how do I create an API token`, a goal like `automate deployments from our CI pipeline` lets GitBook tailor the answer to that use case. The response will contain a direct answer to the question and relevant excerpts and sources from the documentation. Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.