0

I think I discovered a bug on SharePoint Online but maybe this is intended behavior?

When I create a SharePoint Online team site, a home page with different webparts is created. One of the webparts, named "activity" allows to automatically display the recent activity of the site. However, this webpart also picks up emails sent to the Microsoft 365 group linked to the team site! In addition, ALL users of the site can view emails from this webpart (even if these users do not belong to the Microsoft 365 group).

In other words, the "Activity" webpart suffers from a very dangerous data leak if the emails sent to the group are confidential. The Microsoft documentation does not say anything about this except that the web part only displays data on which a user has rights. Which is clearly not the case here. Do you know if this behavior is normal? If not, is there a way to prevent this without deleting the webpart from the page?

Improve this question

1 Answer 1

Reset to default
0

I created a new team site for testing. Are you referring to some of the activities in this Home page? This is the default behavior, and these behaviors are only accessible to authorized users, don't have to worry about it.

enter image description here

=================Update1========================== enter image description here

Improve this answer
2
  • Yes, it is this webpart. However, I tried to log in with a user who only has access to the site and this user can view emails from the Microsoft 365 group. Maybe it's because the Microsoft 365 group is of type "public"?
    – Odo Fiacre
    Commented Jan 27, 2022 at 7:34
  • I have updated the answer, are you referring to the mail like you have successfully joined the group or something? Yes, this can be received.
    – Elsie Lu_MSFT
    Commented Jan 28, 2022 at 9:07

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.