Reminder: Best practices for sharing safely in U-M Box and Google

April 20, 2020

When you share files or folders from Google Drive or Box, you can control the level of permissions granted to others. As a reminder, the U-M Collaboration Services team recommends using caution when you choose permissions for your files and folders to ensure the privacy and security of university data. This is especially true when collaborating with people outside of U-M. It is your responsibility to appropriately share data with only those who should have access to it.

Tips for sharing in Google Drive:

  • Only share your files with those who need it. If the list of users grows too large, we recommend using an MCommunity group to help manage permissions. To learn more about using MCommunity with Google, visit the ITS Documentation Site.
  • Do not use link sharing unless necessary. This opens file access to a much broader audience, with the default being that anyone at U-M with the link can view it. If link sharing is used, make sure appropriate permissions to the file are in place, particularly with external collaborators.
  • External collaborators should either use or create a Google account, as it is the most secure way to collaborate with them. If they are unable or unwilling to use their Google account, the “Send the link (no sign-in required)” option can be used, but the shared link should be removed once the collaborator is done with the file.

Tips for sharing in Box:

  • If you store or share sensitive data, you must use a shared Box account that has been set up for sensitive data and put that data only in the shared account folders set up specifically for that purpose. For more information, see ITS Safe Computing: Use U-M Box Securely With Sensitive Data.
  • Use caution when sharing with collaborators. Because all roles, except Uploader, have the ability to view/add comments by default, only give file access to those who need it. A collaborator’s access should be removed when they are done with the file.
  • Only use shared links when the permissions are set to “Invited people only” to ensure that the file is not available to anyone who doesn’t need it. To learn more about securing shared links, visit Box’s Support Center.
  • External collaborators must use or create a Box account, as it is the most secure way to collaborate with them and the only way for them to access the content.

To learn more about other sharing best practices, visit our ITS documentation pages: