Microsoft 365: Best Practices and Usage

Access rights to SharePoint and OneDrive and individual locations in SharePoint and OneDrive should be managed by IT and assigned by a supervising authority within the agency to prevent unauthorized viewing of records. Access to confidential and non-confidential records on SharePoint and OneDrive should be appropriately managed and folders and file structures should reflect any applicable access restrictions. Access passwords to SharePoint and OneDrive should be securely kept outside of SharePoint and OneDrive. 

It is recommended that documentation be created pertaining to who has read and/or write permission to files maintained by the agency in SharePoint and OneDrive. Default settings for both SharePoint and OneDrive contain metadata concerning who created and/or modified records and when.

Naming conventions on SharePoint and OneDrive should follow the Best Practice For File Naming guidance published by the NC Department of Natural and Cultural Resources. 

The Best Practice guide recommends the following formatting:

• Avoid special characters
• Use underscores instead of periods or spaces
• Be brief
• The file name should include all necessary descriptive information independent of where it is stored
• Include dates and format them consistently
• Include a version number
• Be consistent
   

The Best Practice guidance provides additional detail concerning these recommendations. To recap, file naming should be consistent regardless of whether records are stored locally, on a server or on SharePoint or OneDrive. 

Records stored in SharePoint must be easily navigable by other users, present and future. As such, structuring of the folders and sub-folders should be done in a logical manner. Logical file structuring can provide context to records. The Functional Schedule can provide guidance on how file structures may be patterned by using the functions, sub-functions, and record types as delineated in the schedule as guides. Folder naming should follow the same guidelines used for file naming found in the Best Practice For File Naming guidance published by the NC Department of Natural and Cultural Resources. 

Regardless of how users structure their folders in SharePoint they should avoid creating hierarchies deeper than four or five folders. This can create problems when migrating or moving data. Files may also become unreadable to the operating system and lost in migration if nested too deeply within a hierarchy.

Users of SharePoint and OneDrive must be aware that records stored on either platform are subject to the appropriate retention defined by the Functional Schedule. It is the agency’s responsibility to ensure that records stored in these platforms are retained and accessible until the records disposition instructions are met. Having electronic records policies in place can provide a framework for records with long-term and/or permanent retention (See below for details on electronic records policies). 

Confidential data includes information that if accessed by unauthorized entities could cause personal or institutional financial loss or constitute a violation of statute, act, or law. Below is a non-exhaustive list of records that are subject to confidentiality restrictions: 

• Personal identifiable information such as library records that identifies a person as having requested or obtained specific materials or service
• Confidential communications by legal counsel to public board or agency, state tax information, public enterprise billing information, or records associated with the Address Confidentiality Program, as well as documents related to the federal government’s process to determine closure or realignment of military installations
• Trade secrets or information disclosed or “furnished to a public agency in connection with the owner’s performance of a public contract or in connection with a bid, application, proposal”
• Login/password credentials
• Those that reveal “the electronically captured image of an individual’s signature date of birth, driver’s license number or a portion of an individual’s social security number”
• Those that reveal the seal of a licensed design professional
• State Employee Personnel files (with the exception of certain information that can be disclosed).
• Protected health information (PHI) in any form or medium created or received by a health care provider, health plan, employer or clearinghouse. PHI is defined by the Health Insurance Portability and Accountability Act of 1996 (HIPAA) as health information “that identifies the individual” or “with respect to which there is a reasonable basis to believe the information can be used to identify the individual.”
• The Public Health Law of North Carolina also stipulates the confidentiality of “privileged patient medical information” in the possession of DHHS or local health departments.
• Student records protected by the Family Educational Rights and Privacy Act of 1974 (FERPA).

Confidential records stored on SharePoint and OneDrive should use the following safeguards. 

• Password protection
• Encryption
• The use of Security Alerts whenever a file is accessed.
• The use of a confidential tag in the file's naming structure. 

DIT can provide guidance on how to specifically enable password protection, encryption and security alerts in SharePoint and OneDrive.

Please note that if encrypted or password protected documents are eligible for transfer to the State Archives for permanent retention, they will need to be decrypted and accessible at the time of transfer. See Digital File Transfer Guidelines for more information. 

Agencies should maintain an inventory of all of their records and where their records are stored. It is an Agency’s responsibility to properly purge all records that have met retention requirements, including copies stored on SharePoint and OneDrive. Prior to destruction, agencies should check that they are using the current, approved schedule by checking the posted functional schedule online, consulting your agency’s Chief Records Office, and/or contacting the records analyst assigned to your agency. When digital records are deleted in Microsoft 365, the content is stored in the end user recycle bin for 30 days. Subsequently, tenant-level recycle bins store the deleted content for a total of 93 days after which the files cannot be recovered. 

Records that have met their retention requirements should be destroyed in accordance with the North Carolina Administrative Code. North Carolina Administrative Code 07 NCAC 04M .0510 provides a description of the authorized methods for the destruction of public records in North Carolina. It states: 

“ . . . (b) When used in an approved records retention and disposition schedule, the provision that electronic records are to be destroyed means that the data and metadata are to be overwritten, deleted, and unlinked so the data and metadata may not be practicably reconstructed. 

(c) When used in an approved records retention and disposition schedule, the provision that confidential records of any format are to be destroyed means the data, metadata, and physical media are to be destroyed in such a manner that the information cannot be read or reconstructed under any means.” 

All agencies should maintain logs of their destructions in their Records Management file. Confidential records must be destroyed in such a manner that the records cannot be practicably read or reconstructed.

Unlike SharePoint, OneDrive for Business accounts are tied specifically to an individual employee’s authenticated authorized account. OneDrive accounts and the files stored within may or may not be generally accessible to other employees or IT professionals, depending on whether the records are shared or private. Some Microsoft 365 content is automatically saved in a user’s OneDrive such as Teams chat files, Whiteboards, wikis, and meeting recordings hosted by the user. Employees are responsible for managing their records appropriately and following agency records management policies.

It is crucial to note that OneDrive for Business is tied to the account activated for a state agency employee. In order for this account to be created, the employee must be authenticated and authorized. For Microsoft services, the account is an employee’s e-mail address and NCID password. Because it is the entire email address, each agency has a specific domain within OneDrive for Business; herefore, stored documents will not transfer when an employee moves from one state agency to another. When an employee leaves an agency (even if transferring to another agency), the employee must review documents and files in OneDrive for Business. When a user account is eventually deleted, so is the content associated with that OneDrive for Business account. An employee’s OneDrive account will be retained for five years after separation, during which time the contents will be available to the user’s supervisor and any other designated users, as well as eDiscovery. After that time, any records that a scheduled for permanent and/or archival disposition must be stored elsewhere. For this reason, Human Resource Directors and employees’ supervisors must ensure that migrating files out of OneDrive for Business becomes part of the mandatory offboarding process when an employee leaves the agency. Discuss storage options for records with a permanent and/or archival disposition with your supervisor and/or your agency’s IT professionals. 

Information Technology staff are a critical support piece for records management. DNCR encourages agency management to communicate their storage needs to IT in order to properly manage the records and ensure the appropriate management of information assets. DNCR strongly recommends that agencies form an Information Governance Committee to set policies regarding how and where records are stored and managed. At a minimum, the members of that committee should consist of information technology staff, the chief records officer, the records manager (if applicable), as well as a high level executive sponsor or manager. 

All state agencies should have an Electronic Records Policy in place. This may be done as an agency-wide policy or be broken up into separate policies concerning specific divisions, sections, or other organizational structure. The Electronic Records Policy is designed to be used as a self‐evaluation tool to ensure that electronic records produced by state agencies are able to be retained for the designated retention period and are created, reproduced, and otherwise managed in accordance with guidance produced by the Department of Natural and Cultural Resources. Agencies should address SharePoint and OneDrive usage in their respective policies.

While SharePoint and other Office 365 programs can store a variety of file formats, not all formats are considered archival. File formats are considered archival when those formats meet the minimum requirements for long-term retention, including documentation, wide adoption, transparency, self-containment, and use within the archival community. 

Any file with a permanent or long-term retention requirement should be saved in an archival file format. You may find a list of those recommended formats in File Format Guidelines for Management and Long-Term Retention of Electronic Records.