Users demanding more flexible file sharing

Posted by jstar77@reddit | sysadmin | View on Reddit | 17 comments

We are mostly old school with on prem data centers, file servers with departmental shares and users home directories, and Windows Desktops managed by GPO. I'm pretty sure we are going to be forced to roll out OneDrive and Teams/Sharepoint as an additional supported service for users. OneDrive seems like a pretty straight forward process to replace a users home drive but replacing the functionality of the departmental share that we have with ACLs based on rolls seems like a management nightmare. Is anybody pre-creating teams for departments? Do you allow anyone to create a Team/SharePoint site and permission in however they want? I'm looking for any advice or cautionary tales that you might have from your own experience. It seems like the OneDrive deployment and hybrid domain join are the secret sauce to integrating easy file management with SharePoint/Teams. I have a small consulting budget that I can use to help me get this project pointed in the right direction.

Reply to Post

17 Comments

[-]

FarmboyJustice@reddit

If you're moving to 365, keep in mind that OneDrive and Sharepoint Online have different limits. OneDrive gives you a lot of storage for each user, enough that most users won't ever need to delete anything. SPO is stingy with the storage, so try to reserve it for those who need the collaborative and web functionality.

[-]

AP_ILS@reddit

OneDrive has a lot of limitations you should read up on because it may not be as simple to migrate your users as you think. Sharepoint has even more limitations especially regarding permissions and large libraries. If you have the funds, I would hire a Sharepoint consultant and go over the various workflows with them and have them build things out for you.

[-]

Cautiousfdf@reddit

100% this

[-]

jstar77@reddit (OP)

I do have some consulting budget available I am probably going to be reaching out to someone soon.

[-]

J2E1@reddit

Man, we're in the same boat, but we're migrating from a wild west mess on old systems onto new with better department shares, etc.

[-]

jstar77@reddit (OP)

We have a very nice structured automated role based permissioning for on prem file servers. It feels like moving to Teams/Onedrive is a security and manageability step backwards.

[-]

h00ty@reddit

it is not... Onedrive/SharePoint is easy as you can auto-sign/sync with Intune policies. Tie in SharePoint access to a security group just like a file share.. once set up correctly it will just run in the background.

[-]

AppIdentityGuy@reddit

Remember you can create dynamic m365 groups in Azure AD/O365 which can be used to control Teams access. Also you have a feature in Azure AD Identity Governance that you can use to enforce attestation of access requirements.

[-]

occasional_cynic@reddit

Oh God, don't do this. Groups was a half-implemented feature (for example, you cannot export or import calendar entries), and groups are actually different on the backend than Teams groups, creating even more confusion. Unless you are talking about security groups rather than Outlook groups, in which case I apologize.

[-]

AppIdentityGuy@reddit

Well you can create both types and I've used both types with some success... It's just an example of how the cloud often has different approaches and new ways of doing things and there not always one to analogies. It's one of the reasons I'm glad MS renamed Azure AD TO EntraID. Far too many people running around saying Azure AD is just AD in the cloud...

[-]

Thin_Ad936@reddit

You can limit group/site creation to a specific group of people. I went a step further and automated the whole process to make sure the groups are adhering to naming standards and are created with preset document libraries, flows and some extra stuff. Only specific users can fill out a form that feeds the flow. It's nice once you have it going, but it was a fight to finally get it how it is now.

[-]

jstar77@reddit (OP)

The last I checked limiting group creation for this purpose also broke group creation for things like personal distro lists, is this still the case?

[-]

False-Information-61@reddit

We personally allow users to make their own teams, mainly due to us working for school districts. But it's a case by case scenario and tbh it makes sense to have a team group per department instead imo with the manager as the head to change and modify it.

[-]

jstar77@reddit (OP)

Allowing only one team per department would be something you would have to do with policy only right? The last time I looked the only way to stop a user from creating a Teams team was to disable AAD group creation through PowerShell which had some other unintended side effects.

[-]

False-Information-61@reddit

You can make the teams group and then appoint an admin to manage it.

[-]

TrippTrappTrinn@reddit

We let users create teams. It is their data, so their responsibility to decide who has access. This also mean they can delete them, which has caused a few desperate tickets..

[-]

IveSeenAThingOrTwo@reddit

But it's not the user's data it's the institutions data and data getting where it shouldn't go can open up the organization to a whole host of liabilities. MS makes it pretty hard to control data access as you would have with an onprem system. You can turn off the ability to share data outside of your tenant but restricting data sharing between users or classes of users in the same tenant is not easy.