Stack Exchange Network

Stack Exchange network consists of 175 Q&A communities including Stack Overflow, the largest, most trusted online community for developers to learn, share their knowledge, and build their careers.

Visit Stack Exchange

Questions tagged [security]

Security is the protection of information and property from theft.

0
votes
1answer
29 views

Allow files to be shared, with a label

Label within AIP/ARM can be used to restrict sharing with external users. But is there a way to do the opposite? So I would like to allow users to share specific files when a certain label is added. ...
0
votes
0answers
6 views

Office Online Server - Permissions Configuration

Is there a way to control which buttons are visible within the OOS Iframe? For example, if I wanted to block certain users from downloading the link, what would be the best approach for me to remove ...
0
votes
1answer
12 views

setting up and limiting access to specific fields in a record

We have 3 different groups of people who are adding data to a table or group of tables. We need to restrict viewing of the data at the field level for 2 groups of people. We also have a need to ...
0
votes
1answer
25 views

Sharepoint Online: How to display internal corporate websites, without HTTPS?

We have several internal web applications that do not require the HTTPS protocol, as they are purely accessible internally within our intranet. Obviously with Sharepoint Online, our websites will not ...
0
votes
0answers
28 views

Can I disable “Allow double escaping” on a SharePoint web site?

We're working on hardening our SharePoint server, and STIG V-76825 IISW-SI-000229 mandates that "Double encoded URL requests must be prohibited by any IIS 8.5 website". Basically, editing the Request ...
0
votes
1answer
30 views

html or javascript code injection in sharepoint

How safe is SharePoint with Code injection (HTML,Javsscript, SQL) because for example the Announcements list allows to enter embed Code in the TextBox. Can this be a threat or SharePoint is already ...
0
votes
0answers
8 views

guests users AAD, SecurityGroups and unique permissions

We are having a tenant with like 60 external guest users (added them as #EXT# in AAD) In order to control and manage these users I'm putting them in O365-securitygroups, after they accepted the ...
0
votes
1answer
19 views

Is there anyway to restrict FOLDER access by IP address?

We want to publish some Data for our team, this Data is restricted to only team members, but, we want them to access it only by 1 IP without restricting access to other folders.
0
votes
1answer
31 views

Creating a secure .Net WebAPI for Sharepoint

I have created a Custom Web API using .net C# that will be called in my sharepoint online and i was wondering if is there is anything i could use from sharepoint and use it in my WebApi to verify that ...
0
votes
1answer
56 views

Can I use elevated permissions using JSOM, CSOM, or REST?

I am working with an On-Premise SharePoint 2016 farm and I am looking for some way to elevate permissions, so I don't use the logged-in user's credentials but another set of permissions that the ...
1
vote
1answer
31 views

Hide parts of a Sharepoint Online Site

I have created a very basic SP site in SP Online. I am using modern pages. Basically I have some promoted links (using third party app) that users can click and open up different apps, links, etc. I ...
0
votes
1answer
21 views

User profiles not available in security

I have a SharePoint 2016 on-prem server farm that I manage. It is set up to sync users from Active Directory and everything appears to be working fine. Since there are multiple OUs containing ...
0
votes
1answer
34 views

Is it possible to upload the same file, to multiple document libraries?

Is it possible to quickly upload the same file to multiple document libraries? The reason I want to do this is because I have multiple document libraries because they each have different security ...
0
votes
1answer
32 views

Error in removing SharePoint Solution

I am trying to remove the user solution. I used site.Solutions.Remove(Solution) But I am getting error The security validation for this page is invalid. Click Back in your Web browser, ...
1
vote
0answers
22 views

Where / How is security information passed to SharePoint?

If I execute a query in SharePoint, my security information is passed along with the query. I'm using Developer Tools in I.E.(F12) and am trying to see where this information is passed. Can anyone ...
2
votes
1answer
85 views

Missing 'Strict-Transport-Security' header in sharepoint web application

we have SharePoint site deployed on the internet and when we scan some security settings we found below issue Missing 'Strict-Transport-Security' header Scanner discovered that the affected ...
1
vote
2answers
28 views

SharePoint and OpenPGP file encryption

If I have SharePoint on an azure cloud which can be accessed from any computer using a browser, is it possible to integrate client side PGP encryption so when files are uploaded, they are encrypted ...
3
votes
0answers
149 views

How to get the Data of PWA Settings Security entities? (Using CSOM or REST API)?

I want to get the Groups and Users from PWA settings-> Security tab using CSOM or REST API? How do i get it?
0
votes
1answer
529 views

O365 Security Groups don't appear to be working with SharePoint Online

Today in an effort to clean up our SharePoint permissions and centrally manage things a little more efficiently, we compared our Active Directory groups (OUs) to our groups in SharePoint. I created ...
1
vote
2answers
50 views

SP 2010 Office Web Apps question

I had a quick question. We are in the process of remediation vulnerabilities in our existing SP 2010 environment (Both Windows and SP) There are two updates below that we need to install for SP 2010 ...
2
votes
0answers
118 views

How to prevent Cross Site Scripting attack in sharepoint search

In SharePoint 2013 how to prevent cross-site scripting attack, I deployed a publishing portal to the internet users and its enabled Anonymous access and web application enabled claims mode ...
0
votes
1answer
72 views

SharePoint Web-services disabling automatically causing site down

SharePoint search host controller and SharePoint Server Search 15 disabling every time I enable it. Reason I found that recently I have changed service account password which is used for those two ...
1
vote
0answers
78 views

IRM group access, all users who currently have access on SharePoint

I have found an article whilst looking into applying IRM to SharePoint libraries here: https://docs.microsoft.com/en-us/azure/information-protection/office-apps-services-support Within the article, ...
3
votes
1answer
89 views

Make SharePoint list partly confidential

There is monthly confidential data I want to collect from my firm's subsidiaries through a SharePoint list, directly connected to my workfiles (Excel, Power Bi and related PPT). The existing ...
0
votes
0answers
13 views

Is it possible for a SharePoint Online app under 'Your Apps' to open a security hole?

We are considering adding a third party app and I'm not sure where to start with assessing whether or not this app might cause a security problem. By 'security problem,' I mean exposing user or ...
0
votes
1answer
31 views

Sharepoint security trimming and OneDrive for business

If I have library with 2 folders, and John Smith have access to only one folder - would both be visible for him, if he connects this lib with OneDrive for Business? Does security trimming work in ...
1
vote
0answers
48 views

SharePoint Windows logging - account was successfully logged on 4624 - why so frequent?

My company has a centralized logging platform for all servers. We recently noticed that the bulk of our events come from SharePoint servers for successful logon events. If I look at "Event Viewer" -> "...
0
votes
1answer
448 views

Why are SharePoint security updates failing through Windows update repeatedly, then succeeding?

We have several single-server SharePoint 2013 farms running on Windows 2008 R2. When we do monthly patching through Windows Update, non-SharePoint patches install successfully. However, all SharePoint ...
0
votes
1answer
216 views

SP2010 “NT AUTHORITY\Authenticated Users” group versus the SP2013 “Everyone” group?

In my test SharePoint 2010 instance, I notice SharePoint has a special group called NT AUTHORITY\Authenticated Users In my SharePoint 2013 instance, I notice I have a special group called Everyone ...
2
votes
0answers
130 views

SharePoint Online Access Requests for Users not in Directory

We have a requirement for users not in our O365 tenant to be able to submit an access request to our SharePoint Online site. Normally, if a user in a tenant doesn’t have access to a site, they will ...
1
vote
0answers
27 views

Intended Audience Header/Banner and Security Control

We are currently in SharePoint 2013 on-prem and soon to be in 2016 on-prem (we are not going to SharePoint online yet). Our goal is to provide a clear statement/header/banner of who should have ...
1
vote
2answers
46 views

How can a specific user be allowed to upload a file to a library, but not read that file?

A specific account will upload files from many different machines all over the internet to one folder in a SharePoint library. Content of the files is sensitive in nature, so if a malicious attacker ...
2
votes
2answers
431 views

Can you disable Delve for a particular site?

For example, the board site is making an executive nervous that another board person can see what they are doing in delve.
2
votes
3answers
5k views

How to disable “edit page” for members in Sharepoint?

I want to allow members to edit/create/delete/update list items, but when I allow permissions "edit", the edit page link is accessible to them: I've tried solutions, such as: Break inheritance and ...
2
votes
2answers
36 views

Security Update Application

Microsoft has released a Security Update which applies to SP2010/13/16. Description of the security update for SharePoint Server 2010: January 9, 2018 CVE-2018-0789 | Microsoft SharePoint Elevation ...
1
vote
2answers
216 views

security updates for SP 2013 farm

I am trying to update security updates for SP 2013. I tried to download one security update it has almost 52 items.How can I install these all items in one shot or quickly.Please suggest quickly.
1
vote
3answers
72 views

Boss needs SharePoint site only he can access (so not even administrator can)

I have a good one for ya today. Let me give you a quick backstory so you may understand these needs better. We had an employee who was a system administrator at my current company. Since he was a ...
1
vote
2answers
29 views

same web application there is any way to set farms authentication only to a specific site or site collection without extend or change host name

Hi i configured windos and Farms based authentication for web application,when i login to secured pages it redirect to login page and has options to select windows and farms authentication, but in ...
0
votes
2answers
524 views

Setting “NtfsDisable8dot3NameCreation” on Win Server 2012 running SharePoint 2013

I have a public SharePoint 2013 site with publishing feature as well as custom applications deployed. Recently we had a security audit on the server by and independent security analyst to identify ...
0
votes
1answer
97 views

Whitelist SharePoint Online Hosted App?

The scenario is this: We have a Web Service which is hosted in Intranet Network Plan is to expose Web Service to Internet so SharePoint Online Hosted App can access it Problem is security. If there ...
1
vote
1answer
29 views

Feed request Ip

In one of our Office365 Sharepoint pages, we are consuming a RSS Feed. The feed provider filters out the requests from unknown IP's. It looks like the Request IP occasionally changes, so the feed ...
1
vote
1answer
35 views

Lists that can only be opened by specific users

I want to use SharePoint 2007 or 2010 for our periodic access reviews. The current process is I have an excel sheet in the sharepoint and line managers open it to review the access of their staff. The ...
0
votes
1answer
542 views

User Account LockOut - SharePoint 2013

I have a control requirement: AC-7 Unsuccessful Logon Attempts The information system must define and enforce a limit on the number of consecutive invalid login attempts by a user. And it should: ...
0
votes
1answer
648 views

SharePoint List- Group Item/Row Level Security

I have a list of more than 4000 records for global sales team. I would like to set security permissions for viewing and editing according to the country column value. The issue is that I need to set ...
3
votes
1answer
61 views

A user seemingly modified a document after their account was deactivated

Our company uses Office 365. A user left and our IT team confirms that her account was disabled in June. There's a document in SharePoint showing that she created it in April (ok) and edited it in ...
0
votes
0answers
109 views

Location Based Access To SharePoint Online Site Collection

Currently, there is an IP address location restriction applied in Azure to prevent access to all of our O365 tenant. Access to our tenant from outside of our organisation is disabled based on an IP ...
1
vote
0answers
19 views

Is there any security concerns to enable http options?

My recent vulnerability assessment report flagged the HTTP OPTIONS is enable as unsecure practice. However, developer told me that it is necessary to enable so that end user may use the MS Explorer ...
2
votes
0answers
82 views

Can SharePoint 2010 support validateRequest=“true”?

By default, web application web.configs have validateRequest="false". Changing it to true breaks SharePoint significantly, based on my own trials. People Pickers don't work, half the form pages don't ...
1
vote
0answers
128 views

Why are SP security updates showing as Missing/Required?

Let me preface by saying, I already ran the Get-SPProduct -local but I think it's because the security updates are not there. I have a couple questions regarding security updates and patching as this ...
0
votes
1answer
228 views

Should we disable client integration in internet site (anonymous access) due to WebDAV issue?

There is a link that MS advises to disable client integration feature to prevent cross site scripting "In the event there is a cross site scripting attack using WebDAV by contributors to a site, a ...