Security Policies

Security policies let you define and enforce sharing rules across your SharePoint sites. Instead of configuring each site individually in SharePoint, you create a policy in Tenaxis and apply it to as many sites as you like - all at once.

What Is a Security Policy?

A security policy is a set of rules that controls:

• Who can share content from a site (internal only? external users? anyone?)
• How sensitive the site's data is (the classification label)
• What kind of sharing links are created by default
• What permission those links grant (view-only or edit)

When you apply a policy to a site, Tenaxis pushes these settings directly to SharePoint through the Microsoft Graph API. This means the restrictions are enforced in SharePoint itself - not just visible in Tenaxis.

The Four Built-in Policies

Tenaxis comes with four pre-built policies that cover the most common scenarios. You can use these as-is or as a starting point for custom policies.

1. Strict - HR / Legal

For sites containing sensitive HR, legal, or financial data

Use for: Employee records, contracts, legal matters, salary data, health information, M&A documents.

2. Internal Only

For sites meant for internal use with occasional trusted partner access

Use for: Internal policies, team wikis, internal tooling documentation. Partners who are already guests in your M365 tenant can access if explicitly added.

3. Project Team

For active project sites that may include external collaborators

Use for: Project collaboration sites where you might invite agency staff, contractors, or partners. External users must be explicitly added as guests first.

4. Open / Public

For sites meant to be broadly shared, such as intranet pages or public knowledge bases

Use for: Public-facing documents, company-wide wikis, publicly available resources. Be careful - files shared from this type of site can be accessed by anyone who has the link, including people outside your organization.

Creating a Custom Policy

If the built-in policies don't fit your needs, create a custom one:

1. Go to Policies in the left sidebar
2. Click New Policy
3. Fill in:
   • Name - A clear, descriptive name (e.g., "External Contractors")
   • Description (optional) - Explain when to use this policy
   • Sharing Capability - Choose from:
     • Disabled - No external sharing
     • Existing external users only - Only guests already in your M365 directory
     • External user sharing only - Can invite external users
     • Anyone with a link - Fully open sharing
   • Classification - PUBLIC, INTERNAL, CONFIDENTIAL, or RESTRICTED
   • Default Link Type - None, Direct (specific people), Internal, or Anonymous
   • Default Link Permission - View or Edit
4. Click Create Policy

Applying a Policy to Sites

Applying to a Single Site

1. Open the site from the Sites list
2. Click Apply Policy in the site detail view
3. Select the policy
4. Click Apply

Applying to Multiple Sites at Once (Bulk Apply)

1. Go to Policies
2. Click on the policy you want to apply
3. Click Apply to Sites
4. Select the sites you want to update (you can select all)
5. Click Apply

Tenaxis will push the settings to all selected sites simultaneously. The changes are reflected in SharePoint within a few seconds.

Monitoring Policy Compliance

On the Sites list, you can see at a glance which sites have a policy applied. Sites without a policy have a higher risk score - applying policies is one of the most effective ways to reduce your organization's risk score.

The site detail view shows:

• Which policy is currently applied
• When the policy was last applied ("Last Verified")
• If settings in SharePoint drift from what the policy requires, a re-apply will correct them

Understanding the Settings

Sharing Capability

This controls who can receive a sharing invitation or link from the site:

Classification Labels

Classification is a label that indicates the sensitivity of data on the site:

Default Link Type

When someone clicks "Share" in SharePoint, what kind of link gets created by default:

Default Link Permission

What the sharing link allows the recipient to do:

Policy vs. Manual SharePoint Settings

Important: Policies in Tenaxis write directly to SharePoint. If someone manually changes sharing settings in the SharePoint Admin Center or on the site itself, those changes will be visible in Tenaxis as a "drift" from the applied policy.

To re-enforce the policy, simply click Apply again from the site detail view. This will overwrite manual changes and restore the correct settings.

This is why using Tenaxis policies is better than managing SharePoint settings directly - it gives you a central, auditable record of what each site's settings should be.