Unstructured Data Visibility
Seeing and governing who can access sensitive file shares, sites, and folders alongside structured entitlements.
The blind spot classic governance leaves
Most identity governance is good at structured access — an entitlement, a group, a role, a licence — the tidy, enumerable objects a system exposes. But a large share of an organisation's sensitive data does not live behind a neat entitlement. It lives in unstructured places: SharePoint sites, OneDrive personal drives, network file shares, Google Drive and Box folders. A folder called "Payroll 2026" or "M&A Eagle" can be readable by dozens of people through permissions that never pass through the governed model at all.
Unstructured data visibility is the lens that closes that blind spot: it shows who can access sensitive unstructured content, flags the risky exposure, and gives you a path to bring it under governance. This is a deliberate differentiator — visibility that leads to governance, not a static report.
What the lens shows: folders with sensitivity and exposure
The unit is a folder (a share, site, or data location). For each one the lens surfaces:
| Attribute | What it tells you |
|---|---|
| Source and path | Where it lives — SharePoint, OneDrive, network file share, Google Drive, Box |
| Sensitivity | low, medium, high, or critical, with tags such as PII (personally identifiable information) or Confidential |
| Reader / writer / owner counts | How many people can read, write, or own the content |
| External count | How many of those are external guests |
| In-scope flag | Whether this folder is governed inside the platform, or sitting outside it |
| Risk flags | Over-shared, external access, sensitive-but-outside-governance, crown jewel, stale owner |
A summary row of counts sits on top — total folders, high-sensitivity folders, folders outside governance, over-shared folders, folders with external access — and each count is a filter you can click into, so triage starts from the number that worries you.
"Observe before you govern"
The posture is deliberate: you observe first. A folder can be visible in the lens without being under active governance — you can see its sensitivity, its reader list, and its risk flags before you decide to bring it into scope. This matches the platform's broader onboarding philosophy, where read-only visibility is a first-class step that earns trust before any write happens. Classic governance tools are weak at fast, easy visibility; here it is the entry point.
Concretely, an out-of-scope folder is still fully observable. Bringing it in scope is the deliberate act that links it to the governed model — described below.
The reader list is the core question
The single most valuable thing a data owner needs is the actual reader list: who, specifically, can access this folder, and how? The lens answers that with each reader resolved to a real name, email, department, and identity type — grouped by permission level (reader, writer, owner) and with external guests flagged by their email domain. A truncated identifier is not an answer; a named, readable list is.
For a large estate this is presented as a count with drill-in rather than every row at once — a hot folder can have tens of thousands of readers — so the list is searched and paged server-side.
💡 Tip
The reader list is what turns "this folder is high-sensitivity" into an action. Spotting one external guest and one leaver still able to read "Payroll 2026" is the moment a data owner knows what has to be revoked.
Governed like any other access
Unstructured data is deliberately not left as a disconnected silo. What is built today ties it into the platform's ownership, reconciliation and advisor; reviews are not yet part of it:
- A folder is an ownable object. It has an owner, assigned from the folder's detail panel through the standard ownership model.
- Reader reviews are not built yet. There is no action on a folder that launches an access review or asks its owner to attest the readers, and no request-a-revoke action. Today the reader list tells you who to deal with; the review itself happens outside the lens.
- In-scope folders link to a governing entitlement. When a folder is brought into scope it references the entitlement that governs it, so its readers reconcile like any other assignment — the reconciliation engine, the audit trail, and the assignments view all see them. Out-of-scope folders stay standalone, visibility-only.
- Risk flags reach the advisor inbox. Signals such as sensitive-outside-governance, over-shared, crown jewel (owner-less and highly sensitive), and stale owner are raised as recommendations in the Platform Advisor — the platform's single inbox — so unstructured findings sit next to everything else that needs attention.
Two everyday jobs
Triage sensitive exposure. A security officer scans the estate for high-sensitivity folders that are readable outside the governed model, opens a crown jewel, sees it is owner-less or over-shared or has external guests, and acts: assigns an owner and takes the finding to whoever can remove the external access.
Check a leaver's residual access. When off-boarding someone, the reverse of the lens answers "which sensitive shares can this person still read?" straight from their profile — the unstructured slice of the leaver flow — so the ticket is not closed while a leaver can still open "Payroll 2026".
Where the data comes from, and turning it on
Folder data is collected by a connector scan, once a day per connector. Four sources are built: SharePoint (through the Entra connector), Google Drive, Box, and on-prem SMB/NTFS shares. SMB runs through the on-prem agent, because the platform cannot reach a file server directly. For SMB, external exposure is flagged from broad well-known principals such as Everyone, Anonymous and Authenticated Users, and a domain SID that cannot be resolved to a name is shown as the raw SID.
The scan is honest about what it could not read:
- A folder whose permissions could not be read is left out of that run and keeps its last known state. It is never shown as "nobody can open this".
- A scan stops at 5,000 folders by default (
max_foldersin the connector's engine configuration, and you can raise it). When a scan is cut short or a site, drive or share could not be listed, the sweep reports it as incomplete instead of treating the missing folders as absent. - Scan depth is scope, not a limit: Box scans three levels and SMB scans two by default, the same on every run.
File shares is a preview and is off by default. The nav item, the daily scan, the folder-risk findings in the Platform Advisor and the "residual access" view on an identity profile all stay off until an administrator switches the preview on under Subscription › Previews (until 25 October 2026 this was the pkg.unstructured_data_preview package; see starter packs and lifecycle mails). The switch is audited and read-only users see its state. An administrator sees the File shares page also while the preview is off, so it can be looked at before it is switched on; readers such as auditors only get it with the preview on, and the demonstration-data button only shows on a tenant with the preview on. Two items remain open before it becomes a default: the demonstration-data path is not yet retired, and resolving on-prem Active Directory SIDs to names needs a real domain to finish.
💡 Tip
A tenant with the feature on but no scanning connector bound sees the lens on demonstration data behind a clear banner. The shape is real; the numbers are illustrative until a source is connected. One folder with a real connector origin switches the banner off.