SharePoint Connector - Security

Overview

This document describes security practices, update policies, and the Software Bill of Materials (SBOM) for the SharePoint Connector.

Security Updates

Security update cadence and release lifecycle expectations follow the canonical Upgrade and Release Process. Review this policy when planning upgrade windows and patch rollouts.

Security Reports

If you identify a potential vulnerability, report it through your standard Unique support/security contact and include connector version, affected tenant/environment, and reproduction details. Release handling expectations follow the Upgrade and Release Process.

Security Architecture

Security Principles

Least Privilege Access

• Sites.Selected / Lists.SelectedOperations.Selected: Only access explicitly granted sites or libraries
• No tenant-wide access: Cannot access sites not specifically granted
• Per-site/library revocation: Access can be removed from individual sites or libraries

Certificate-Based Authentication

• X.509 certificates: Industry-standard authentication
• No shared secrets: Certificate private keys never leave the connector
• Rotation support: Certificates can be rotated without service disruption

Transport Security

• TLS 1.2+: All external communication encrypted
• Certificate validation: Server certificates validated
• No plaintext: No unencrypted data transmission

Data Handling

• Streaming transfers: Files streamed, not stored locally
• In-memory processing: Data processed in memory
• No persistent storage: No local file storage of SharePoint content
• Tenant-wide principals: SharePoint permissions granted to tenant-wide principals (e.g., Everyone, Everyone except external users) are not expanded or synced to Unique. Content accessible to all tenant users in SharePoint may not have corresponding visibility in Unique permissions

Compliance Considerations

Data Residency

• Connector does not store SharePoint content persistently
• Data flows: SharePoint → Connector (memory) → Unique
• No intermediate storage

Audit Logging

All operations are logged with:

• Timestamp
• Operation type
• Resource identifiers
• Success/failure status
• Error details (if applicable)

Access Controls

Best Practices

For Operators

1. Rotate certificates before expiration
2. Review site grants periodically
3. Monitor logs for anomalies
4. Update promptly when security patches released
5. Use certificate authentication for production environments

For Security Teams

1. Review SBOM for each deployment
2. Assess CVEs against deployed version
3. Audit site grants for least privilege
4. Monitor API usage for anomalies
5. Test in staging before production updates

Standard References

• Microsoft Security Best Practices - Microsoft security guidance
• OWASP Top 10 - Web application security risks
• CycloneDX - SBOM specification
• SPDX - Software Package Data Exchange