Egnyte Security: Permissions, Links, SSO and Audit Reports Configured Well

An Egnyte domain usually holds a company's working files, its partner folders and its file server data synced from the office, so folder permissions, link settings and admin roles decide who can read almost everything the business produces. This guide covers the customer side of securing Egnyte: user types and Role-based Administration, folder permission levels and inheritance, domain and folder sharing options, SAML single sign-on, SCIM provisioning and two-step login verification, service accounts and API credentials, audit reports, and the Secure and Govern classification and lifecycle services. It is written for Egnyte administrators, IT and security teams, and auditors who need to know which settings to change and how to prove they are working. For the general practice of sharing files with outsiders, see the Secure File Sharing Guide.

This is an independent guide from NHI Mgmt Group, based on Egnyte's public documentation as of November 2026. It is not sponsored or reviewed by Egnyte. Product features change, so confirm settings against Egnyte's current documentation.

Key takeaways

• Grant narrow at the top, wider below. Egnyte recommends minimal access on top-level folders and assigning access lower down, because access flows to sub-folders unless inheritance is turned off.
• Set link types and expiry at domain level. Under Sharing options, choose which of the four link types users may create, make a private type the default, and set a default and a maximum expiry for public and private links.
• Put people on SSO and SCIM. SAML 2.0 SSO plus SCIM 2.0 provisioning means joiners, movers and leavers in your identity provider reach Egnyte without manual work; turn on two-step login verification for anyone who still uses an Egnyte password.
• Treat service accounts as privileged identities. Their passwords do not expire and two-step verification does not apply, so vault the credential, give the account only the role it needs, and review it like an admin.
• Export audit reports before they age out. Audit activity is kept for three months, so schedule the File, Permissions, Login, Provisioning and Configuration Settings reports and archive them or feed them to your SIEM.

How identity and access work in Egnyte

Egnyte separates user type (what features and admin functions an account has) from folder permissions (what an account can do in a given folder). Both have to be right: a Power User with Owner on the wrong top-level folder is as exposed as an extra administrator for that data.

Folder permission levels

• Default for invitees: people invited to a folder get Editor by default. Change it to Viewer when the invitation is for reading only, especially for Standard Users.
• Owner is the sharing right: only administrators and folder owners can grant, change or remove access. The Classic UI calls Owner "permit". Treat Owner as a delegated admin right over that folder tree.
• Inheritance: access flows to sub-folders. You can change access on a sub-folder or turn inheritance off for a folder. When a grantor does not own a sub-folder, the cascade stops at that point and its permissions stay as they were, so check sensitive sub-folders after any bulk change.
• Groups over people: share with groups by name so access follows group membership, ideally groups pushed from your identity provider. See the Least Privilege Techniques Guide.

Single sign-on, SCIM and two-step verification

SSO is set under Settings, Configuration, Security & Authentication, in the Single Sign-On Authentication section. Choose SAML 2.0, select your identity provider, and enter its login URL, entity ID and certificate or upload its metadata XML. Pick a Default user mapping (email or Egnyte username as the IdP username). If SSO users need (S)FTP or WebDAV, an API key is entered in the same section. Egnyte publishes configuration guides for providers including Okta and Microsoft Entra ID.

• SCIM 2.0: with a SCIM-capable provider (the Okta guide is the documented example), users assigned in the IdP are created in Egnyte, profile changes flow through attribute mapping, groups and members can be pushed and linked to Egnyte groups, and deactivating a user in the IdP deactivates the Egnyte account. Deactivated accounts are not deleted and can be reactivated manually, so plan your own deletion and content-transfer step.
• User type via SCIM: valid values are admin, power and standard (case-sensitive). If none is set, the user is created as a Power User. SCIM cannot change power user roles and assigns the default role, so delegated admin rights stay a manual, reviewed change.
• Two-step login verification: configured in the same Security & Authentication page. The "Require two-step login verification for" setting offers All Users, Admins & Power Users only, or Standard Users only, and admins can require it per user. The admin guide describes authenticator apps (Authy and TOTP apps such as Google or Microsoft Authenticator). Users who sign in through SSO can be excluded, which is the right choice when your IdP already enforces MFA.

For outside partners on Standard User accounts, who authenticate with Egnyte passwords, our recommendation at NHI Mgmt Group is to require two-step verification for Standard Users and apply the password controls below. See the Identity Provider and SSO Security Guide and the SCIM Provisioning Guide.

Admin roles and privileged access

Every administrator can reach all content, so the number of administrators is the single biggest lever on insider and account takeover exposure. Role-based Administration lets you hand specific functions to Power Users instead of making them full admins. The docs give examples such as Plan Details page access, Standard User management and top-level folder creation, plus a reporting role used to run audit reports.

Use delegation for partner account management, departmental top-level folder creation and team-level reporting (the reporting role needs Viewer or higher on the folder). Keep security settings, SSO and sharing options with named administrators, because those changes have domain-wide effect.

• Break-glass: keep one administrator able to sign in if the IdP is unavailable, with a long password in a vault and two-step verification on, and alert on its logins in the Login Audit Report.
• Reviews: list administrators and delegated roles quarterly, and compare against the Configuration Settings and Permissions audit reports. See the Access Reviews Guide.

Integrations, API tokens and service accounts

Egnyte integrations authenticate either as a person or as a service account, an Egnyte account meant for an application rather than a user. Egnyte names Storage Sync, Smart Cache and applications built on the Egnyte API as examples, and recommends a service account when adding an Egnyte source to Secure and Govern.

• Credentials: administrators generate API credentials (a Client ID and Client Secret) from the Apps & Integrations store, and Egnyte recommends a service account for API access. Store the secret in your secrets manager, never in scripts or shared folders. See the API Key Management Guide.
• Role: a service account can be an Administrator or a Power User. Choose Power User and grant folder permissions only where the integration works, unless the integration genuinely needs domain-wide access.
• Password handling: service account passwords do not expire for Egnyte-authenticated accounts and two-step verification does not apply. Our recommendation: rotate the password and API credentials at least annually and whenever an integration owner leaves, and record an owner for each account. When provisioning service accounts through Okta, the docs say to set Sending Invite Email to False and reset the random password in Egnyte.
• Interactive use: service accounts cannot use the WebUI, desktop or mobile apps, which helps; alert on any Login Audit Report entry for a service account from an unexpected source.

Keep an inventory of every service account, its integration, owner, role and folders. See the Service Account Security Guide.

Link sharing and folder sharing policies

Domain sharing settings live at Settings, Configuration, General, Sharing options. Folder sharing grants the permission levels above; a file or folder link lets the recipient download only. Links are therefore the main route for content to leave the organisation.

• Folder-level overrides: under Folder Details & Options, Options tab, owners and admins can allow public file and folder links, allow public file links but not folder links, or prohibit both. Prohibit public links on HR, finance, legal and board folders. Changes flow to sub-folders that have no manual changes, so verify the result.
• Expiry timing: links expire at 11:59 PM on the chosen date in the creator's time zone.

Logging and detection

Audit reports are available to administrators and to Power Users with the reporting role, on plans that include them (the Permissions Audit Report page names Business, Enterprise Lite and Enterprise platform plans). Audit activity older than three months is purged automatically, so export or archive regularly. Use Save/Schedule Query to run a report on a schedule and archive it; Export downloads a CSV and Archive saves a CSV into Egnyte. Feed the archived CSVs, or the audit API described on Egnyte's developer portal, into your SIEM.

Secure and Govern adds monitoring on top of audit reports: its Access Control service flags non-secure links, reviews sharing with outside parties, audits permissions across repositories and spots unusual user activity to help prevent insider data theft. See the Insider Data Theft Guide.

Metrics that show it is working

• Public link share: public links as a percentage of all active links, trending down.
• Links without expiry: target zero once the maximum expiration is set.
• Accounts on Egnyte passwords without two-step verification: target zero.
• Administrator count: reviewed quarterly against a named list.
• Audit export coverage: days of audit history held outside Egnyte, at least your retention requirement.
• Sensitive-content locations: Secure and Govern locations holding PCI or GDPR matches with public links or external users, trending to zero.

Secure and Govern classification and lifecycle

Secure and Govern has three services. Content Classification finds sensitive information using built-in policies for PCI-DSS and GDPR, which can be turned on in one click, and custom policies you define; it lists locations holding sensitive content and lets you drill down to individual files. Access Control covers the permission and link issues above. Content Lifecycle sets retention, deletion and archive policies by location or classification and applies legal holds by custodian.

1. Connect sources: add the Egnyte domain using a service account, as Egnyte recommends.
2. Classify first: enable the built-in PCI-DSS and GDPR policies, then add custom policies for your own identifiers such as customer or employee numbers. See the Data Classification Guide.
3. Fix exposure: work through locations where sensitive content meets public links or outside users; tighten the folder-level link option or permissions.
4. Set retention: apply retention and deletion by classification. A locked retention policy can only be changed by Egnyte Support, so lock only after legal sign-off. See the Data Retention and Secure Deletion Guide.

Hardening baseline

These are customer-side settings under Egnyte's shared responsibility model. Values marked as ours are NHI Mgmt Group recommendations.

Phased rollout

1. Inventory: export users by type, administrators, service accounts and active links; run the Permissions Audit Report for top-level folders.
2. Identity: configure SSO with the optional login path, test with IT, then move all Power Users and admins to SSO and enable SCIM.
3. Second factor: require two-step verification for Standard Users and remaining Egnyte-password accounts; announce a date first.
4. Sharing: set expiry defaults and caps, then change the default link type; existing links keep working, so review and expire old public links in a second pass.
5. Folders: restructure top-level permissions to minimal access and prohibit public links on sensitive trees.
6. Rollback: each change shows in the Configuration Settings audit report with its previous value, which is your record for reverting a setting that breaks a workflow.

Common misconfigurations

• Broad Owner rights at the top: giving a department Owner on a top-level folder lets any member re-share and change permissions for the whole tree.
• Public links with no cap: setting a default expiry without a maximum lets users choose links that never meaningfully expire.
• Service accounts as admins by habit: an integration that needs one folder runs with domain-wide access and a non-expiring password.
• Audit history lost: no scheduled export, so an investigation finds only the last three months.
• Deactivated, never removed: SCIM deactivation leaves accounts and owned folders in place until someone transfers or deletes them. See the Joiner-Mover-Leaver Guide.

Framework mapping

Practitioner checklist

• Move all employees and administrators to SAML 2.0 SSO and enable SCIM 2.0 provisioning with group push.
• Require two-step login verification for Standard Users and every account still on an Egnyte password.
• Reduce administrators to a named list and use Role-based Administration for delegated tasks.
• Restructure top-level folders to minimal access and grant Owner only to folder stewards.
• Default links to Private (recipients-only) and set default and maximum expiry for public and private links.
• Prohibit public links on sensitive folders through Folder Details & Options.
• Create one least-role service account per integration, vault its credentials and record an owner.
• Schedule audit report queries and export them before the three-month purge.
• Turn on Secure and Govern classification for PCI-DSS, GDPR and custom identifiers, and fix exposed locations.
• Apply vendor security updates to desktop apps and Storage Sync promptly.

Standards and references

• Egnyte: Folder Permissions
• Egnyte: Share Settings
• Egnyte: Two Step Login Verification Admin Guide
• Egnyte: Service Accounts
• Egnyte: Reports and Auditing Overview
• Egnyte: Secure and Govern Overview
• NIST: SP 800-53 Rev. 5 Security and Privacy Controls
• NIST: Cybersecurity Framework 2.0

Related NHI Mgmt Group resources: Secure File Sharing Guide · SaaS Security Guide · Data Loss Prevention (DLP) Guide · Service Account Security Guide