1

I'm trying to wrap my head around the Site Policies and the Site Closure and Deletion in SharePoint Online for non-Self Service created sites. It seems like it is nice in theory but looks like it is easily bypassed.

As a SCA (and global admin in O365), I can go in and create the policies. No problem. I can then assign the policy to the site. Since this Closure and deletion is under Site Administration, anyone listed in the owner group can simply remove the policy in place by setting it to No Site Policy.

We want to be able to use this feature to enforce retention, but this seems like a gaping security hole. What if any workarounds are out there? Remote CSOM on timers to check and set it every day if it is not found?

This seems to be reinforced here.

1

By default, Site Owners have Full Control of Site Administration, which is the same on SharePoint Server as SharePoint Online. Being a member of Site Owner means the user is trusted and have the knowledge and ability to create, read, update and delete Site Policies which should be used in Site Closure and Deletion. If you trust the user to be in the Site Owner group, then this shouldn’t be a problem and you can create a company policy for how Site Policies and Site Closure and Deletion is supposed to be used. That doesn’t create a technical restriction for changing the Site Policy themselves, but they violate company policy if they do. That should keep trusted users from changing policies by themselves.

If you want a technical restriction, you need to create a Custom Security Group without Full Control of Site Administration, but that will effectively stop them from other actions as well.

  • Ya that just doesn't seem like it will fly. Does that seem like a security hole to you? For project spaces I can see this being fine, but for team sites, I don't see it as being effective and that the retention/closure/deletion process would need managed outside the environment. – Eric Alexander Apr 7 '15 at 12:01
  • @PirateEric I wouldn’t categorize it as a security hole. But I would categorize it as missing features. I understand the need to have a group of owners doing some, but not all, administrative work. Kind of like the way you administer Office 365 with Billing admin, Password admin, Service admin, User management admin and at the top Global admin. – Benny Skogberg Apr 7 '15 at 12:15

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.