ShareFile is often where firms exchange tax returns, contracts, patient forms and board packs with clients, so who holds employee rights, how share links behave and how sign-in is enforced decide how well that data is protected. This guide covers the customer-side settings in ShareFile: employee users and client contacts, employee permissions and folder permissions, share link access options and the maximum link period, multi-factor authentication and SAML single sign-on, OAuth tokens and application-specific passwords, reports, and customer-managed storage zones controllers. It is written for ShareFile administrators, IT teams at professional services firms and the security staff who review them. For sharing practice in general, see the Secure File Sharing Guide.
This is an independent guide from NHI Mgmt Group, based on ShareFile's public documentation as of November 2026. It is not sponsored or reviewed by ShareFile. Product features change, so confirm settings against ShareFile's current documentation.
Key takeaways
- Keep MFA required for both user types. MFA is turned on automatically for employees, client contacts and new accounts; keep Required selected for each type rather than accepting the opt-out confirmation.
- Require SSO for employees. Turn on Require SSO sign in so non-admin employees authenticate through your identity provider, and protect the Admin-role accounts that can still use ShareFile credentials.
- Set the share default and the ceiling. Choose a signed-in access option as the default, turn off the public options you do not need, and set a maximum share link period.
- Treat employee permissions as admin rights. Permissions such as Manage Employees, Access company account permissions and Configure single sign-on settings are privileged; hold them in a small, reviewed group.
- Run reports in 90-day windows and keep them. Reports run in 90-day increments, so schedule recurring Access, Access Change and Share reports and keep the exports.
How identity and access work in ShareFile
ShareFile has two kinds of people. An employee user is an internal user who consumes an employee licence and can be given account permissions. A client contact (client user) is an external user whose access is limited to the shared folders they are added to. By default ShareFile will not create a client with your company's email domain, which keeps staff on employee accounts where your policies apply; admins are emailed to review such requests.
| Identity | How it signs in | Customer control |
|---|---|---|
| Employee (non-admin) | SAML SSO when Require SSO sign in is on; otherwise ShareFile password plus MFA | Require SSO; permissions only as needed |
| Employee with Admin role | Can still sign in with ShareFile credentials when SSO is on, so access survives IdP problems | Small group, MFA required, strong unique passwords |
| Client contact | ShareFile password plus MFA; SSO and the SSO requirement do not apply to clients | MFA Required for client contacts; folder-scoped access |
| Applications and scripts | OAuth tokens, or application-specific passwords for tools outside MFA (FTP, User Management Tool, custom API scripts, legacy apps) | Token lifetimes, owner per credential, revoke on leaver |
Folder permissions
| Permission | What it allows | Guidance |
|---|---|---|
| View | View documents without downloading; needed for watermarked viewing (View-Only needs Premium or higher) | Use for review-only sharing with clients |
| Download | Download any document in the folder; includes View | Grant to clients only where they need copies |
| Upload | Upload files and folders and create subfolders | Client intake folders |
| Delete | Delete files the user did not upload | Staff only; users can delete their own uploads by default |
| Admin | Manage folder access, add or remove users, edit some folder options | Folder stewards; the folder Owner cannot be removed |
| Download and Upload alerts | Email notices on folder activity | Turn on for sensitive client folders |
- Inheritance: new subfolders inherit the parent's permissions, and the Apply permissions to subfolders checkbox pushes changes to existing subfolders. A user who creates a subfolder cannot manage its users without Admin on the parent.
- Owner control: by design, account admins, the Super User Group and the account owner cannot change permissions on folders that belong to other users. Plan shared folder ownership deliberately so a leaver's folders have a second Admin who can manage access. See the Joiner-Mover-Leaver Guide.
- Activation links: unused welcome links expire after 30 days, and resending a welcome email deactivates the previous link.
Admin roles and privileged access
ShareFile grants administration through named employee permissions rather than a single admin switch. These are the ones to treat as privileged:
| Permission group | Permission names | Why it matters |
|---|---|---|
| General | Access company account permissions | Changes account-wide permissions |
| People | Manage Employees, Manage Clients, Delegate admin privileges to other employee users, Manage super user group | Creates users, resets MFA, grants further admin rights |
| Company Account Info | Configure single sign-on settings, Access reporting, View notification history | Changes sign-in trust; sees account-wide activity |
| Files and Folders | Create root-level folders in Shared Folders | Creates top-level data areas |
| Connectors | Create and manage connectors, Create SharePoint connectors, Create Network Share connectors | Exposes on-premises content through ShareFile |
| StorageZones | Create and manage StorageZones, Select StorageZone for root-level folders | Decides where data is stored |
- MFA resets: admins with Manage Employees can reset MFA for all users except the account owner (People, Browse Employees or Browse Client Contacts, Actions, Reset Multi Factor Authentication). Verify identity through a known channel before any reset, because a reset lets the next sign-in enrol a new device. See the Vishing and Help Desk Social Engineering Awareness Guide.
- Account owner: the Master Admin or Account Owner cannot be reset by another admin and must contact ShareFile Support. Keep that account's recovery methods and backup codes in a vault.
- Deleting users: only account administrators can delete users. Make deletion part of the leaver process, after folder ownership is handed over.
- Reviews: list employees holding the permissions above every quarter. Our recommendation at NHI Mgmt Group is no more than a handful of holders of Delegate admin privileges and Configure single sign-on settings. See the Access Reviews Guide.
MFA and single sign-on
Multi-factor authentication
Configure MFA at Account settings, Security, Sign in policy, Multi-Factor authentication, Edit. Admins choose the methods available to each user type and select Required for employees, client contacts or both. Methods are an authenticator app, text message and voice call (admins can allow SMS, voice or both; both is the default). Trial accounts use the authenticator app only, and VoIP numbers are not accepted for SMS or voice.
- Method choice: offer the authenticator app first. Our recommendation is to allow SMS and voice only for client contacts who cannot use an app. See the Phishing-Resistant MFA Guide.
- Keep Required on: clearing Required makes MFA optional and asks the admin to acknowledge the risks in an opt-out confirmation. Treat that confirmation as a change needing approval.
- Backup codes: each is single use; users should generate a new batch after using several. ShareFile Support cannot reset MFA for users, so admins handle resets.
- Remembered devices: "Don't ask again on this device" stores a browser cookie token. Shared or kiosk machines should not use it.
- Application-specific passwords: FTP, the User Management Tool, custom API scripts, the storage zones controller configuration page and legacy applications use an application-specific password, which cannot be recovered if lost. Record an owner for each and revoke them for leavers.
SAML single sign-on
Turn on SSO at Account settings, Security, Sign in policy, Single sign on (SAML), Edit, Enable. Enter the ShareFile issuer or Entity ID, your IdP issuer or Entity ID, the IdP's X.509 certificate (public portion) and the IdP sign-in URL. Optional settings include the SP-initiated certificate type (HTTP Post with 2048-bit is the strongest listed choice), Enable web authentication for Sync and the Outlook plug-in with forms-based IdP sign-in, and the SP-initiated authentication context. ShareFile uses SP-initiated sign-in and redirects IdP-initiated attempts into that flow.
- Require SSO sign in: once SSO works, turn this on so non-administrative employees must use the IdP, where your MFA and conditional access policies apply.
- Admin fallback: employees with the Admin role can still sign in with ShareFile credentials if the IdP has problems. That is useful as break-glass, so keep MFA required for those accounts and alert on their direct logins.
- IP restrictions: account IP restrictions are arranged through ShareFile Support.
See the Identity Provider and SSO Security Guide.
Share link policies
Admins decide which access options users can choose when they share, which one appears by default, and how long a link can last.
| Access option | Who can open the link | Our suggested use |
|---|---|---|
| Anyone (public) | Anyone with the link, with no details or sign-in | Turn off unless a team publishes non-sensitive material |
| Anyone (public, must enter a name and email) | Anyone with the link who enters a name and email | Low-sensitivity sharing where you want a record of who opened it |
| Client contacts and employee users (after signing in) | Signed-in users of your account | Default for client work |
| Employee users (after signing in) | Signed-in employees only | Internal sharing |
| Email recipients (only for Outlook) | Recipients of the Outlook email | Outlook plug-in workflows |
- Default access option: set it to a signed-in option so the easy path is the protected one.
- Maximum share link period: set a ceiling. Our recommendation: 30 days for links to client data, shorter for regulated records.
- Get a link: turning off the first four options also turns off Get a link, leaving only sending to named people. Use this for the strictest accounts.
- Malware handling: admins can ask Technical Support to block downloads of suspicious files or require scanning before download.
Integrations, API tokens and service accounts
ShareFile apps and integrations use OAuth tokens. Administrators set OAuth token lifetimes in Advanced Preferences; users can expire their own tokens under My Settings, admins can expire them in Manage Users, and disabling a user expires that user's tokens. Tools outside the MFA flow use application-specific passwords.
- Dedicated identities: run each script or integration under a dedicated employee account with only the folder permissions it needs, not under a person's account, so tokens survive staff changes and can be revoked on their own. See the Service Account Security Guide.
- Token lifetime: shorten OAuth token lifetimes to the minimum your sync and mobile users accept. Our recommendation is to review it with the Sync and Outlook plug-in owners before changing.
- Leavers: disable the user first, which expires tokens, then hand over folders and delete.
- Connectors: network share and SharePoint connectors publish on-premises content through a storage zones controller; restrict the connector permissions above to the infrastructure team.
Storage zones controllers
ShareFile-managed StorageZones run on AWS and Microsoft Azure. A customer-managed storage zones controller keeps files on your own storage; ShareFile notes that customers who manage their own zones are responsible for availability, capacity planning and disaster recovery for that data.
- Network: clients reach the controller over HTTPS on port 443. The controller can use an internal-only address (users then need the company network or VPN), and needs outbound access to the regional ShareFile service bus endpoint. With an external host name, use a certificate trusted by user devices and ShareFile web servers.
- Restricted zones: existing restricted zones keep working and encrypt file and folder metadata with your keys before it reaches ShareFile, with separate authentication to the controller and sharing only to employees or domain users. They are at End of Maintenance status, so new restricted zones cannot be created; plan sensitive-data designs with that in mind and confirm current options in ShareFile's documentation.
- Patching: apply vendor security updates to the controller promptly, and harden the Windows and IIS host like any internet-facing server.
- Backups: ShareFile advises against DFS replication for zones; run separate backups off-peak.
Logging and detection
ShareFile logs account activity including logins, downloads, deletions and user access, and support staff activity is logged and visible to admins. Admins and employees with Access reporting can run 11 reports: Usage, Access, Access Change, Storage Detail, Storage Summary, Share, Request, Users, Bandwidth Detail, Bandwidth Summary and Messaging. Reports run in Eastern Standard Time, export as XLSX or CSV, cover the account lifetime in 90-day increments (Advanced plans are limited to the previous 90 days), and can be recurring.
| Source | What to look for |
|---|---|
| Access report | Unusual download volume by one user or client (ATT&CK T1530) |
| Access Change report | Folder Admin granted to new users, clients added to sensitive folders |
| Share report | Public links on sensitive folders, long-lived links |
| Users report | New employees outside the joiner process, dormant accounts |
| Admin, StorageZones health | Controller offline (no heartbeat for 10 minutes; updates are sent every 5 minutes) |
| Controller logs in C:\ProgramData\ShareFile\StorageCenter\logs | configurationservice for configuration changes and zone joins; storagecenter for uploads and downloads; IIS logs in c:\inetpub\logs\LogFiles\W3SVC1 |
Metrics
- MFA coverage: Required set for both user types; zero opt-out confirmations without an approved change.
- SSO coverage: share of non-admin employees signing in through the IdP, target 100%.
- Privileged holders: count of employees with Delegate admin privileges, Manage Employees and Configure single sign-on settings.
- Public share rate: public links as a share of all links in the Share report, trending down.
- Report retention: months of exported reports held outside ShareFile.
Hardening baseline
- Inventory: run the Users and Share reports and list holders of each privileged permission.
- MFA: confirm Required for employees and client contacts; set allowed methods per type.
- SSO: enable SAML, test with IT, then turn on Require SSO sign in. Keep Admin-role accounts with MFA for fallback.
- Sharing: set the default access option to a signed-in choice, turn off Anyone (public) unless needed, and set the maximum share link period.
- Permissions: trim privileged employee permissions and fix folder ownership so every shared folder has two Admins.
- Integrations: move scripts to dedicated accounts, set OAuth token lifetimes, and record application-specific passwords.
- Monitoring: schedule recurring reports and forward controller and IIS logs to your SIEM.
- Rollback: change one setting at a time with a note of the old value; sharing changes affect new links, so announce them to client-facing teams first.
Common misconfigurations
- MFA made optional: an admin clears Required to stop client complaints, and client accounts fall back to passwords alone.
- Public default: Anyone (public) left as the default access option, so most links need no sign-in.
- No link ceiling: no maximum share link period, so links to client data stay usable for years.
- Scripts on personal accounts: automation runs on an employee's account and stops, or keeps running unnoticed, when that person leaves.
- Single-owner folders: a leaver owns key folders and no one else holds Admin on them.
- Unexported reports: nobody keeps reports, so an investigation has to rebuild history in 90-day chunks.
Framework mapping
| ShareFile control | NIST SP 800-53 Rev 5 | NIST CSF 2.0 | CIS Controls v8.1 | ISO/IEC 27001:2022 Annex A |
|---|---|---|---|---|
| MFA and SAML SSO | IA-2, IA-5 | PR.AA-01 | 6.3, 6.5 | A.5.17, A.8.5 |
| Employee and folder permissions | AC-2, AC-3, AC-6 | PR.AA-05 | 3.3, 5.4 | A.5.15, A.5.18 |
| Share link policies | AC-3, CM-6 | PR.DS-01 | 3.3 | A.5.14 |
| Reports and controller logs | AU-2, AU-6, AU-11 | DE.CM-03 | 8.2 | A.8.15 |
| Storage zones and encryption | SC-28 | PR.DS-01 | 3.11 | A.8.24 |
Practitioner checklist
- Keep MFA Required for employees and client contacts, authenticator app first.
- Enable SAML SSO and turn on Require SSO sign in for non-admin employees.
- Protect Admin-role accounts that can bypass SSO with MFA and login alerts.
- Set a signed-in default access option and a maximum share link period.
- Limit Delegate admin privileges, Manage Employees and Configure single sign-on settings to a small reviewed group.
- Give every shared folder at least two Admins so leavers do not strand access.
- Run integrations on dedicated accounts, set OAuth token lifetimes and track application-specific passwords.
- Schedule recurring Access, Access Change, Share and Users reports and keep the exports.
- Patch and monitor storage zones controllers, and forward their logs to your SIEM.
Standards and references
- ShareFile: Multi-factor authentication
- ShareFile: Single Sign-On (SAML)
- ShareFile: Share settings
- ShareFile: User permissions
- ShareFile: Folder permissions and subfolders
- ShareFile: Reports
- ShareFile: Restricted storage zones
- NIST: SP 800-53 Rev. 5 Security and Privacy Controls
Related NHI Mgmt Group resources: Secure File Sharing Guide · SaaS Security Guide · MFA Guide · Data Loss Prevention (DLP) Guide