1

Background information: I'm new to Office 365 / Sharepoint online, trying to roll out the usage for our comapany. I like to move most important stuff from file server network share to Sharepoint Online. I already managed to create Team- / Communication-Sites so I can build a root structure for the files, and I found out how to sync them to the local machines. By activating sync for one of the sites Windows creates a new Library with an Enterprise Building as a logo, serving as root directory for the document folders of the synced sites.

And here comes my question: What if users (used to file server network share!) create a new file or folder in that Library root via Windows File Explorer? It will not sync back to Shatepoint because there is no site defined (right?). But Windows allowed me to do so: Any suggestions on how to handle this / how to prevent users from creating non-synced files inside their local Sharepoint Library?

Improve this question
2
  • how are you setting up your permissions? I would do so by group and don't give any group/person access to the root level directory - only to the site level directories.
    – mael'
    Jul 10, 2019 at 20:08
  • I did not think about permissions on the machines - thought it would be fine to assign users to the sites in Sharepoint Online to map our access rights. What I would need to go with @mael' s suggestion is something like "no user has write permission to the Sharepoint Library Root (not inherited to the subdirectories)" - right? Can you give me a hint how to realize that? And am I really the only one thinking about preventing that kind of "misuse" of a Sharepoint Library in Windows File Explorer (so that a kind of permission workaround seems to be needed)?
    – martin.lindenlauf
    Jul 10, 2019 at 21:05

2 Answers 2

Reset to default
0

Best practice is to limit permissions using groups - how you divide people/set that up will depend on how your company is structured and what your needs are, but basically you start at the root level where only the administrators have read/write (modify, full control) permissions, then you move into configuring your separate sites that your users will be accessing.

Without specific information on your environment: you should be able to go into the SharePoint section of your Office 365 portal and click on the little gear in the top-right corner of your page (not your Internet Options), from there you can go to Site settings > Site permissions and make sure only groups who need access to the root directory have it. You can continue this process on the Site pages by navigating to them from your SharePoint portal, clicking the little gear, and repeating.

As a reference you can skim through Microsoft's little guide on customizing site permissions; the layout might be different in your environment but for the most part setting things up with groups and having specific sites is the way to go.

Improve this answer
3
  • Thank you for clarifying best practice to limit user permissions inside sharepoint! But this doesn't solve my porblem: a user who only has access to one sharepoint site (which is not the 'root' site) can create files/folders in Windows File Explorer inside `c:\users\[username]\[Company Sharepoint Folder]` after he activated sync for that site - and those are not synced. That's what I like to prevent. I think this has to be set by Windows user rights, not sharepoint settings, am I right?
    – martin.lindenlauf
    Jul 12, 2019 at 13:59
  • No - this is not a Windows permissions issue. If your SharePoint permissions are setup correctly, Windows will throw a \\domain.sharepoint.com@SSL\DavWWWRoot is not accessible. type error if a user even tries to access the directory below sites. Likewise, the folder they are syncing with in that root directory shouldn't be accessible to them via SharePoint either (should throw a You need permission to access this site. message). Double-check your permissions in your root directory via Site settings and make sure no one is in the default groups, or that you limit the default group access.
    – mael'
    Jul 12, 2019 at 17:03
  • Good to know that it should work by setting SharePoint permissions. Unfortunately I'm unable to reproduce - as you described - Windows to throw an error on creating documents in local SharePoint root folder. The user I've tried with has only edit rights on a site collection called TEST - no rights on the root collection (that one which has URL without .../sites/). After activating sync for .../sites/TEST, Windows creates the company folder below c:\users\username\ - and the user _has_write access to that folder => can create new, unsynced files & folders here. How to find out what's wrong?
    – martin.lindenlauf
    Jul 14, 2019 at 14:41
0

I did a test in the environment, and if the user creates a file in the local folder, the file will sync to SharePoint library. enter image description here

You want to prevent this from happening, only through permission settings.

Improve this answer
1
  • If you created a file inside "Team Site - Documents" that's not what I want to prevent. I'm asking to prevent users from creating folders / files at the same level as the "Site-Documents" Folders in Windows File Explorer. These are not synced back. You can see it in my screenshot: "TEST_LocallyCreatedFolder" is at the same level as "TEST_Kommunikationswebsite - Dokumente" which has been created by Windows because I activated sync for the site "TEST_Kommunikationswebsite". "TEST_LocallyCreatedFolder" is not synced (and there is no site in sharepoint to sync to).
    – martin.lindenlauf
    Jul 12, 2019 at 13:21

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.