Blogs

Is the social nature of SharePoint 2010’s MySites putting your information at risk? Would you know if it was? These are questions I thought I knew the answer to, but now I am not so sure. Late last week, we experienced a ripple in the space-time continuum that keeps SharePoint aligned with Active Directory. All of a sudden, I received an email that I had been given control of the MySites of my three employees and my boss received one, telling him that he now had control of my MySite. For some reason, SharePoint thought none of us were employees any longer. Our Systems Administrator sealed this tear in the fabric of SharePoint-AD space and all was well again – except, now everything old is new again.

I logged into SharePoint today, to upload my presentation for AIIM Expo (sorry for the shameless plug) and I noticed a lot of “News” about my “Colleagues”. This is odd, since my colleagues rarely experience anything “newsworthy”. Since we had all been welcomed back to the farm, SharePoint was telling me all about the groups my colleagues are “now” members of and the recent changes to their organizational structure. I studied this page for a while, and I started to think of a few reasons I might not want some of this information to be public.

Group Memberships – Since we refreshed the AD synchronization with SharePoint, I was treated to the news of all the AD groups my colleagues were now members of. I wondered about that for a second when I looked at the group names. We choose names in AD that are easy to figure out, but I’m not sure we always want to advertise their existence. Say for example we had a group of people planning a reorganization, or a new product review or even something as simple as a birthday party for our company president. Do I want everyone in my organization (which includes the company president) to know that I am a member of one of those groups? I can think of times when I would not want the existence of certain AD groups to be known beyond the members in that group.

Timing – Although this is unlikely to affect a small organization like ours, I also wonder about the timing of organizational (including AD) changes. New employees are always established in AD, well in advance of their start date. Do I want people finding out that I have a new employee from their MySite before HR publishes the “Welcome …” email? The same risk could present itself for transfers and temporary assignments. I might be feeling a little too paranoid today for my own good, but these features make me just a bit uncomfortable.

I should have paid better attention to fellow blogger Michael Doyleduring his presentation at SPTechCon last October in Boston, I am pretty sure he pointed out how I could have customized some of these settings before rolling out MySites. We are going to take steps to hide these elements from the Newsfeed, until we can figure out how best to proceed. That decision will involve things like which AD groups to make public, what information to expose in the Newsfeed and how to educate people regarding what most will see as a new type of information – Sounds like Governance issues to me.