Summary:
Uncontrolled external sharing of SharePoint Online can result in significant data exposure. Implementing an approval-driven Power Automate workflow can help ensure that every file is reviewed prior to being shared externally. Files are uploaded to a centralized location, meticulously reviewed, and shared only after receiving approval, providing enhanced visibility and control.
Many organizations face the challenge of unintentional exposure of sensitive information due to uncontrolled external access to SharePoint Online sites. Whether documents are submitted through Microsoft Forms, uploaded by vendors, or collected for reviews, these files often require validation before external access is granted. Without a systematic process, files may be shared externally without proper review or clear accountability for the approving party.
To combat this issue, we developed an “approval-driven Power Automate workflow” that initially reviews uploaded files and only generates an external sharing link after obtaining admin approval. This approach ensures that each document undergoes a verification process before being shared, maintaining secure and audit-friendly external access within SharePoint Online.
SharePoint Site Configuration for Restricted External Sharing:
Before setting up the approval workflow, organizations must configure SharePoint’s external sharing settings and governance controls to enable secure collaboration with external parties. The following baseline configurations are essential for restricting external access, ensuring audit trails, and aligning with organizational policies:
-
Create a Dedicated SharePoint Site: Establish a dedicated site with no direct user access for storing files collected through the workflow. This aids in better access management and ensures consistent handling of external sharing.
-
Enable External Sharing at the Site Level: This will allow the workflow to generate external sharing links only after admin approval.
With these configurations, the final requirement is to select a secure method for collecting files that the workflow will process for review.
How to Choose a Secure File Upload Method in SharePoint:
When collecting files in SharePoint Online, administrators typically choose between two main options, each with its own advantages and disadvantages:
-
File Request: This mode allows anyone to upload files without logging in. While convenient, it lacks control and doesn’t provide a clear method for tracking uploads or obtaining approvals before sharing.
-
Document Library Upload Form: This option limits uploads to internal users and supports metadata, making file tracking and management easier. However, it still lacks a built-in review and approval mechanism before files are shared externally.
To achieve a balance between security and usability, we designed a Power Automate workflow that leverages the Document Library form to gather files, route them for admin approval, and only create an external sharing link upon approval. For instance, if a file like Confidential.docx is submitted, it remains inaccessible to external users until an admin reviews and approves it. Once approved, the workflow securely shares the link with “Anyone” access.
Overview of the External File Sharing Approval Workflow Using Power Automate:
This workflow is intended to ensure that files are reviewed before they are shared externally in SharePoint Online. It operates within a designated SharePoint folder that temporarily stores uploaded files while securely managing approved files.
-
The process starts when a user submits a file using a SharePoint document library upload form.
-
Upon file upload, the workflow automatically triggers, storing the file in the restricted SharePoint site.
-
Admins receive an approval request in either Outlook or Microsoft Teams, along with pertinent details such as:
- File name
- Reason for the upload
- Whether the file is new or an updated version
-
If the admin approves the request, the workflow creates an external sharing link for the file and shares it with the user.
-
If the request is denied, expired, or encounters issues, the uploaded file is automatically deleted, ensuring that unapproved files are neither stored nor shared.
Implementing an Approval Workflow for SharePoint File External Sharing in Microsoft 365:
Administrators can use Power Automate to automate tasks such as onboarding, offboarding, and team creation within Microsoft 365. This workflow guarantees that files are only shared externally after proper admin validation.
Before beginning, ensure the SharePoint site is configured properly and that the following prerequisites are set:
- A dedicated SharePoint site
- An appropriate SharePoint document library form
- Verified Power Automate connections
This guide details how to create an approval workflow for external file sharing in SharePoint using Power Automate step-by-step.
[Continue to Implementation Steps]
