> For the complete documentation index, see [llms.txt](https://docs.docontrol.io/docontrol-user-guide/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://docs.docontrol.io/docontrol-user-guide/risk-management/threat-model-coverage/private-account-sharing.md). # Private account sharing **SaaS security problem** Personal sharing occurs when employees or third-party collaborators share data through private email accounts, which don't have the same level of security as company accounts. This opens the door to data exfiltration and increased risk of account takeover attacks, during and even after employees have left the company. To make matters worse, non-corporate email accounts do not necessarily meet your organization's security standards such as multi-factor authentication (MFA), so sharing data with private accounts is extremely risky. **DoControl solution** DoControl allows you to limit private account sharing by approaching SaaS data permissioning from a position of least privilege. You can remove unauthorized access from shared assets. This helps to minimize data overexposure, and mitigate the risk of data loss. DoControl leverages these tools to automatically monitor, mitigate and remediate the risks associated with private account sharing across a variety of apps: * [Inventory of private accounts](#inventory-of-private-accounts) * [Inventory of trusted domains](#inventory-of-trusted-domains) * [Alerts](#alerts-for-private-account-sharing) * [Playbooks](#playbooks-for-private-account-sharing) ## What's a private account? A private account is a non-corporate, unauthorized email account, which might not meet your organization's security standards. A non-business contact that originates from a free email account, such as gmail or yahoo, could be an attempt to exfiltrate data. These email platforms as a rule do not require multi-factor authentication (MFA), which makes them the weak link in any chain of enterprise security solutions. Private accounts could be used by external collaborators, such as partners, customers, service agencies, third-party vendors, and other parties not employed by your organization. ## What's the risk? Data shared with unauthorized, non-business contacts (such as private email addresses) could be an attempt to exfiltrate data. Moreover, personal email platforms as a rule do not require multi-factor authentication (MFA), which makes them the weak link in any chain of enterprise security solutions. After an employee resigns or is terminated, they should no longer have access to sensitive company data. Access might be shared with a third party – a vendor, a colleague, a friend, or even a competitor. ## Inventory of private accounts DoControl displays your organizational posture to highlight snapshot data, including top exposed private accounts in Google Drive, OneDrive, and SharePoint. DoControl exposes which private accounts (e.g. gmail, yahoo) have the most access to data in your organization.

Number of assets shared with top five private accounts in Google Drive

#### To remediate the risk of private account sharing in SharePoint, OneDrive, and Google Drive: 1. From the Organizational Posture page, select the relevant site: * Google Drive * OneDrive * SharePoint 2. Navigate to the **Top exposed private account** tile. 3. To view more details, click the account or asset link.

List of assets shared with an external user

4. In the external user page, you can see exactly which assets were shared with this private account, and details of those assets, including the owner and sharing status. 5. Remediate using any of these DoControl actions: * Next to the user's name, click **Remediate > Inventory actions > Remove permission** to remove all access to company assets. * Select the relevant assets you want to remediate and the relevant inventory action: * **Change owner** - Move the assets to an appropriate location or remove them altogether from Google Drive, OneDrive or SharePoint. * **Remove external collaborators** - Remove all external permissions to the selected assets. ## Inventory of trusted domains You can define workflows to prevent sharing assets with specific domains: * **External domains** - Domains with external users who have access to assets in your organization. * **Not in trusted domains** - Not part of the subset of internal and external domains that are considered safe for sharing. {% hint style="success" %} Tip: You need to define a list of [trusted domains](/docontrol-user-guide/saas-data-monitoring/inventory/inventory-domains.md#trusted-domains) before creating [workflow conditions](/docontrol-user-guide/workflows/define-workflow-settings.md) that refer to trusted domains. {% endhint %} ### Use trusted domains in workflow conditions After you define your list of trusted domains, you can use them as conditions in workflows. 1. Define your organization's list of [trusted domains](/docontrol-user-guide/saas-data-monitoring/inventory/inventory-domains.md#trusted-domains). 2. Create a workflow; for example with a change user access event. 3. Add a condition that checks if the asset was shared with a domain from the non-trusted domains list. 4. Use either one of these comparators to filter specific domains: * In trusted domains: True or false * Not in trusted domains: True or false ## Alerts for private account sharing DoControl alerts automatically notify your organization when anomalous user behavior occurs. External sharing alert types indicate excess permission privileges that were granted to external users outside your organization; for example, assets shared with private email accounts. To mitigate the risk of exposed data as a result of sharing with private email accounts, DoControl provides these alerts:

Alert type	DoControl alert name	Alert description
DC7	Shared with private email	This alert will trigger when an internal user shares data with a non-corporate email account, which might not meet your organization's security standards.

{% hint style="info" %} For details about DoControl alerts, go to **Help > DoControl Alert Specifications**. {% endhint %} ### How to remediate alerts? If your organization receives alerts notifying you of private account sharing, you can delete the relevant collaborators on-demand using the **Remove external collaborators** inventory action. You can also set up a workflow that will remove external collaborators whenever a file is shared with a private email account (immediately or after a given time frame). DoControl's remediation measures for private account sharing are according to SaaS app: * **Box, OneDrive, SharePoint** - With DoControl, you can remove external sharing permissions from the exposed assets. It is also recommended to set up a workflow that will auto-expire or prevent sharing data with private emails. * **Dropbox** - In the Dropbox console, you can remove specific external collaborators by hovering over the asset you’d like to manage and click the share icon. In the dialog box, click on the "X people have access" link to select which collaborators to remove. Alternatively, you can remove the sharing link altogether. * **Google Drive** - With DoControl, you can remove external sharing permissions from the exposed assets, or deny the target's access to any asset in Google Drive. It is also recommended to set up a workflow that will auto-expire or prevent sharing data with private emails. {% hint style="info" %} You can apply inventory actions to remove external collaborators from assets in these SaaS apps: * Box * Google Drive * OneDrive * SharePoint {% endhint %} ## Playbooks for private account sharing To address the use cases of private account sharing across various SaaS apps, you can define automated workflows with DoControl's out-of-the-box playbooks. These playbooks will: * Automatically notify and remediate by removing external collaborators (private accounts) from Google Drive, Box, and Microsoft 365 assets. * Automatically notify and remediate when about-to-leave employees share assets with private accounts. * Define a timeframe to automatically remove external collaborators (private accounts) from Google Drive assets.

Select a predefined DoControl playbook to remediate private account sharing

{% hint style="info" %} See the DoControl [demo video](https://youtu.be/pRgMPmwK4eA) to configure auto-expiry of files shared with private email accounts. DoControl's best practices will help you to minimize data overexposure, and mitigate the risk of data loss. {% endhint %}

Playbook name	SaaS app	Playbook description
Remove sharing with private accounts	Box	When someone shares a file from Box with a private email account, the actor is notified, and the external collaborators are automatically removed.
Auto-expire sharing with private accounts	Google Drive	When someone shares an asset from Google Drive with a private account, the actor is notified by email, and any external collaborators who have private email domains are removed after 30 days.
Remove sharing with private accounts when offboarding	Google Drive	When an about-to-leave employee shares an asset from Google Drive with a private account, the SecOps team is notified by Slack. Any external collaborators who have private email domains are automatically removed.
Remove sharing with private accounts	Google Drive	When someone shares an asset from Google Drive with a private email account, or with a specific email domain, the actor is notified by Slack, and any external collaborators from these domains are automatically removed.
Remove sharing with private accounts	OneDrive	When someone shares a file from OneDrive with a private email account, the SecOps team is notified and the external collaborators are automatically removed.
Remove sharing with private accounts	SharePoint	When someone shares a file from SharePoint with a private email account, the SecOps team is notified and the external collaborators are automatically removed.

--- # Agent Instructions This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com. ## Querying This Documentation If you need additional information that is not directly available in this page, you can query the documentation by asking a question. Perform an HTTP GET request on the following URL with the `ask` and `goal` query parameters: ``` GET https://docs.docontrol.io/docontrol-user-guide/risk-management/threat-model-coverage/private-account-sharing.md?ask=&goal= ``` `ask` is the immediate question: it should be specific, self-contained, and written in natural language. `goal` is what the user is ultimately trying to achieve, the reason they need the answer. Sharing it helps GitBook give you a better, more relevant answer. A goal is most helpful when it describes the outcome the user wants rather than restating the question. For example, with `ask=how do I create an API token`, a goal like `automate deployments from our CI pipeline` lets GitBook tailor the answer to that use case. The response will contain a direct answer to the question and relevant excerpts and sources from the documentation. Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.