Security for Minimode links

  • 23 September 2021
  • 3 replies
  • 70 views

When using the minimode links to a process map, it seems like anyone who got access to the link could view the map. This would include people outside of our company. Is there a way to limit access to minmode to only company employees?

 

Thank you.

 


3 replies

You're correct -anyone with the minimode link can access that version of the process. If there is a new version published, they will still see the old version.

There is a workaround (not perfect) - to prevent external users accessing them, you can make sure "Minimode links to restricted processes require login" is turned on (it is by default) then add every process group into a new permission that you grant all your staff. It will force them to be logged in, although if you have SSO they won't notice anything.

I've found that many concerns with visibility (by external groups of internal processes) are less about others having our data, not so much our process steps.  Our steps can often be visible, but when we include links to resources, downloaded content, contact lists, etc. - THOSE are the things we want to protect (rightfully so).  


We promote the best practice of linking to managed shared spaces, rather than uploading the actual content.  So, rather than uploading a document into the tool that has the team's birthdays, I would link to that file's location on our Google Drive.  The link itself will not allow folks who do not already have access to our Google Drive to see the file.


 


Check out this minimode for examples: https://us.promapp.com/ucsd/Process/Minimode/Permalink/GSlM0o2gcNqwtbDP612HmI

Userlevel 2
Badge +6

You're correct -anyone with the minimode link can access that version of the process. If there is a new version published, they will still see the old version.

There is a workaround (not perfect) - to prevent external users accessing them, you can make sure "Minimode links to restricted processes require login" is turned on (it is by default) then add every process group into a new permission that you grant all your staff. It will force them to be logged in, although if you have SSO they won't notice anything.

Can you describe how this might impact embedding minimode content on a sharepoint page? 

Presumably the additional verification affects the content and prevents it from displaying?

I’m guessing the SSO functionality doesn't work when the content is displayed in an Iframe component on a sharepoint page.

Reply