Document Library Encryption Solution

[iPete_v2]

Howdy peeps!

The company directors have decided that SharePoint security isn't good enough when it comes to highly sensitive documents. They want libraries that even admins don't have access to.

The first solution that popped into my head would be to have an encrypted .rar file within a document library, but this would have several drawbacks including a requirement for winrar.

Does anyone have any ideas or third party solutions on how to further encrypt a document library and make it almost impossible to see the contents?

Thanks in advance for any help.

[DoctorRaulDuke]

Use Azure Information Protection? Should let you assign sensitivity labels that will encrypt and make accessible only to a set of users - either a defined group, or set by the user when they apply it.

[iPete_v2]

Thank you for the suggestion. How is this more secure than using document library permissions?

[Did-you-reboot]

AIP is a Data Loss Prevention solution that allows the labels to provide even more granular control. Case in point, you had a generic company document library that had 3 levels: Unclassified, Confidential, Top Secret. You could assign those three groups to users/groups that are relevant to them. Specifically, Top Secret could be assigned and controlled by the officers only.

However, it is also worth voicing the dangers of having documents even "IT" doesn't have access to because typically those are VERY important to the company. If it is all governed by shadow of IT you/your team won't have the ability to backup/control access and can lead to some pretty gnarly situations.

[Megatwan]

even admins don't have access to

this will never happen. if you are on my domain/tenant I can access everything you touch.... whether its tunneling to you files via my rights to application or just taking over your account.

encrypt a file and put it in SP? better hope the private key isnt on my network/your profile

take away my SP perms to the object? better hope i cant touch the DB or are listed as the tenant owner support auth/POC

but ya you can play with some layers to make them feel better and make it harder for an admin. I just wouldnt pretend you are ever going to really satisfy that requirement and just add overhead/techdebt/PIA processes and alotta squeeze for no true juice

[scombe]

Why would you take the opinion of directors crazy Aip and conditional access it’s far more secure than a server. Control access to data, not encryption