Thursday, November 14, 2013

Disabling SkyDrive Pro in Office 365

SkyDrive Pro in Office 365 is a personal area where users can store files. Every user in Office 365 currently receives 25GB of space allocated to them, that can be increased up to 100GB if desired. However, what happens if you don’t want users to have access to this web based file storage in office 365? Can it be disabled? Yes it can. Here’s how.

image

A user’s standard SkyDrive Pro looks something like that shown above. To remove this access the first thing you’ll need to do is login as an administrator to the Office 365 portal.

image

In the top right of the portal you’ll find an Admin option, which if selected will display the menu shown above. From this menu select SharePoint.

image

In the SharePoint admin center select user profiles from the menu on the left and then Manage User Permissions from the People section on the right.

image

You should see here that the group Everyone except external users has the rights to Create Personal Site. To prevent any future users from creating or accessing SkyDrive Pro simply Remove this group.

image

If the box is blank, as shown above then no new users will have access to SkyDrive Pro. You can of course individually add users and group in here for whom you wish to have the ability to create SkyDrive Pro at any stage.

What does that look like if a newly created user now attempts to access SkyDrive Pro?

image

When they try and access SkyDrive Pro from the menu across the top of their account by selecting SkyDrive they will be taken to the Newsfeed tab as shown above.

Can you remove the SkyDrive option from the menu bar across the top of the page? Not at this stage.

Now that is all well and good for NEW users, what about that already have SkyDrive Pro set up? Can that be disabled? Yes it can but the process is much more involved.

A users SkyDrive Pro is basically a SharePoint subsite created in the Site Collection:

http://<tenant name>-my.sharepoint.com

under /personal

Now the primary administrator for the Office 365 tenant (i.e. the first login assigned when the tenant was created) has full rights to the site collection

http://<tenant name>-my.sharepoint.com

however they only have read rights (like every other Office 365 licensed user) by default to another individuals SkyDrive Pro. Thus, if that administrator navigates to a users SkyDrive Pro they can view it but not make changes. This needs to be changed so the administrator can take control.

image

To change the ownership of an individual users existing SkyDrive Pro site you need to return to the SharePoint admin center and select Manage User Profiles from the People section in the right hand side of the screen.

image

Now run a search for the user whose SkyDrive Pro you wish to modify. In this case Lewis Collins as shown above.

image

On the right of the Account name you will find a down arrow which when selected will display the menu above. From this menu select Manage site collection owners.

image

By default you will see the users name listed as the Primary and Secondary Site Collection Administrator. You’ll need to remove the user from both locations and the recommendation would be to add the administrator so that the site still can be managed.

image

Thus now, Lewis Collins no longer should have access, only Robert Crane (i.e the tenant administrator) does.

Once that is saved the administrator should now be able to access the URL of the users SkyDrive Pro and be able to edit the site.

image

You’ll know you’ll be able to do that if when you select the Cog icon in the top right of the screen you see a menu like that shown above that includes the menu item Site Settings. Select this item to continue.

image

Select Site Permissions from under the Users and Permissions section in the top left of the page as shown above.

image

Select the user from the list by placing a check mark to the left of their name and then selecting Remove User Permissions from Ribbon menu.

Don’t forget that the user is still a member of the group Everyone except external users, so if you don’t also edit that security group in Office 365 and remove them from there they will continue to have read access.

If however no one except the administrator needs access to this users SkyDrive Pro Site then simply remove the group Everyone except external users using the same process above.

image

In this case we only want the administrator to have access so we have removed everything displayed. The administrator will continue to gain access to the site no matter what rights are modified in the actual SharePoint site because they where made a Site Collection administrator previously.

image

Return to Site Settings using the Cog in the top right hand corner of the window.

Now select Site collection administrators from the Users and Permissions section in the top right as shown above.

image

If any items appear in here that you don’t want to gain access (i.e. the user Lewis Collins) remove them and press OK to save.

image

Return to Site Settings again and this time select People and Groups at the top of the Users and Permissions section.

image

If the user appear here, place a check to the left of their name and then select the Actions menu.

image

From the menu select Delete users from Site Collection.

image

Press OK to continue.

You might ask why didn’t I do that first and remove the user from the Site Collection in one action? The reason is, I wanted to illustrate how many locations it is possible to provision rights. I would therefore highly recommend you check all areas I have run through here to ensure the user no longer appears.

So finally,

Before, with normal SkyDrive Pro access:

image

After, with no SkyDrive Pro access:

image

Now when a user visits their SkyDrive Pro they will no longer see any files or they will no longer be able to upload documents. Basically, they have no access.

You need to beware of the fact that a users SkyDrive Pro area is a dedicated SharePoint site in which the user has full admin rights when it is created. This means that can change permissions, create subsites with different permissions and so on. It is like giving users full access to a folder on a network drive.

The easiest way to prevent a user from accessing SkyDrive Pro is to disable the account or remove their rights to SharePoint, however the above scenario illustrates that you can still permit access to SharePoint but not SkyDrive Pro, even if SkyDrive Pro for that user has already been created. It is a lot of work to do that but at least you know how to if you need to. Just beware that there may be further permissions enabled by a user (perhaps giving buddy hidden access) that you may have to dig out. Finger crossed, most users won’t alter the defaults but beware they certainly have the power to if they want by default!