OneDrive and SharePoint Permissions, Delve, and Office 365
If you use OneDrive for Business, SharePoint, or other applications in Cornell Office 365 to save and share documents, make sure the sharing settings for each folder and document are what you want them to be. As with Box, Cornell’s other storing and sharing tool, OneDrive and SharePoint have options to let you control exactly who has access to what.
Unique to Office 365, though, is Delve, a feature designed to help surface materials that might be of particular interest, either because you need to use them frequently, or because people you work with are working on them.
While this activity is useful, it also means it’s important not to rely on documents staying private simply because they’re in a folder that’s hard to navigate to. Delve shares files to individuals who have permission to see them and doesn’t make them visible to people who don’t.
This means that when storing documents and files in OneDrive for Business and SharePoint, it’s extra important to check the permissions of the folder or file. Avoid sharing with "Everyone" or using a folder named “Shared with Everyone.” This group includes any user who can authenticate with a NetID to Active Directory, including alumni, retirees, and service accounts (holding IDs).
Additionally, most regulated data types are not permitted in Cornell’s Collaboration storage tools, like Office 365 SharePoint Online, OneDrive for Business, Box, and Confluence.