Smartsheet often holds budgets, project trackers, HR lists and customer data, and two features decide who outside the company can see it: sharing with collaborators and publishing items to a link. Both are powerful, and both are governed by settings a System Admin chooses in Admin Center. This guide explains how to secure Smartsheet from the customer side: authentication methods and domain strict sign-in, admin roles, the Safe Sharing Policy, publishing controls, API access token expiration, and Event Reporting. It is written for Smartsheet System Admins, collaboration platform owners and data security teams. For the wider discipline of controlling shared links and external collaborators, see the Secure File Sharing Guide; this page stays specific to Smartsheet.
This is an independent guide from NHI Mgmt Group, based on Smartsheet's public documentation as of November 2026. It is not sponsored or reviewed by Smartsheet. Product features change, so confirm settings against Smartsheet's current documentation.
Key takeaways
- Turn on domain strict sign-in. On Enterprise, Admin Center authentication settings let you limit users on your domains to the methods you enable, such as SAML, with an MFA-protected System Admin fallback.
- Use the Safe Sharing Policy. It restricts sharing to allowed domains and email addresses, but items shared before it was turned on stay shared, so run a sheet access report.
- Decide on publishing deliberately. "Anyone with the link" publishes without sign-in and can include "Edit by Anyone"; "Same-plan users only" requires login by internal users.
- Set API token expiration. Tokens stay active until revoked unless a System Admin sets an expiration, which applies to existing tokens from their creation date.
- Collect Event Reporting. The Event Reporting add-on exposes
GET /eventswith sharing, publishing, export, login and token events for your SIEM.
How identity and access work in Smartsheet
A Smartsheet plan is administered in Admin Center (admin.smartsheet.com) by System Admins. Company email domains are added and validated under domain management, and validated domains anchor both sign-in policy and the Safe Sharing Policy. Users then reach items through direct shares, workspace shares and, where allowed, published links.
| Authentication option (Smartsheet docs) | What it does | Recommended use (NHI Mgmt Group recommendation) |
|---|---|---|
| Email + Password / One-time Password via Email | Standard sign-in with an optional MFA setting | Keep only as the MFA-protected System Admin fallback once SSO is enforced |
| Google, Microsoft Azure AD (Entra ID), Apple | Sign in with those identity accounts | Allow only the method that matches your corporate identity provider |
| SAML | Single sign-on through your identity provider, configured with the provider | Primary method for all corporate domains |
| Domain strict | Users on selected domains can sign in only with methods enabled on the Authentication page | On for every validated corporate domain |
| System Admin fallback | "Keep Email + Password/One-time Password via Email for Sys Admins (fallback)", which can require MFA; selectable per domain | On, with MFA required, for a small set of break-glass admins |
Authentication settings are available on Enterprise with System Admin permissions, under Admin Center > Menu > Settings > Authentication at domain level, or from the Authentication card on the Admin Center home page at plan level. Smartsheet warns that enabling or disabling a method affects all users it covers, so confirm every affected user keeps at least one working sign-in method before you turn one off. See the SAML Security Guide.
Leavers: deactivate users in Admin Center or through your identity provider integration, and review items they owned. Event Reporting records USER - DEACTIVATE, which helps confirm offboarding completed. See SaaS deprovisioning.
Admin roles and privileged access
Smartsheet's Admin Center controls are held by System Admins, with Group Admins able to work with Security Controls pages for their groups. Item-level control sits with item Owners and sharing Admins, who can share and publish the items they manage.
| Role | Relevant privileges (Smartsheet docs) | Least-privilege guidance |
|---|---|---|
| System Admin | Authentication, domain management, Governance Controls (Safe Sharing Policy), Security Controls including publishing and API token expiration; Event Reporting access | Two or three named people; MFA on the fallback sign-in; quarterly review (our cadence) |
| Group Admin | Listed with System Admin for Security & Controls pages | Delegate for group management instead of granting System Admin |
| Item Owner and Admin | Share items and publish sheets, reports and dashboards where publishing is allowed | Brief owners on publishing and sharing policy |
System Admin is the role that can switch the Safe Sharing Policy off, which immediately removes all sharing restrictions, so alert on POLICY_SAFE_SHARING and SECURITY_CONTROLS events. See the SaaS Admin Account Protection guide.
Safe Sharing Policy
The Safe Sharing Policy (Enterprise, System Admin) restricts the email domains and addresses users can share items with. It sits under Admin Center > Governance Controls > Data Policies, on the Safe Sharing Policy card. At least one validated domain is needed first.
| Element | Behaviour (Smartsheet docs) | Recommended practice (NHI Mgmt Group recommendation) |
|---|---|---|
| Domains allowed | Entered without the @ symbol; activated domains are included automatically | Your domains plus approved partner domains, each with an owner |
| Email addresses allowed | Individual addresses, no domain validation needed | Use for named external collaborators, with an end date in your records |
| Request link | "Input URL here" link shown when someone tries to share outside the list | Point to an IT ticket form so requests are recorded |
| Existing shares | Items shared before the policy remain shared with outside addresses | Run a sheet access report and remove unapproved shares |
| Turning the policy off | Immediately removes all sharing restrictions | Restrict to change control and alert on it |
| Premium apps | Fully supported for Bridge, Calendar, Dynamic View and Pivot; DataMesh inherits the user's permissions and list; Brandfolder uses its own link settings | Configure Brandfolder and other premium apps in their own admin settings |
Integrations, API tokens and service accounts
Smartsheet's API accepts user access tokens and OAuth 2.0 tokens. Each token acts with the permissions of the user who created or authorised it, so a token used by an automation is a non-human identity tied to a person's account.
- API token expiration: Enterprise System Admins set a duration under Admin Center > Security & Control > API Access Token, in minutes, hours, days, months or years. It is off until enabled. Once set, existing and future user and OAuth 2.0 tokens in the plan follow it, counted from each token's original creation date, so some existing tokens can expire at once. Users get an email seven days before expiry.
- Plan the change: tell token owners before enabling expiration so automations are re-keyed rather than broken. Expiry is set per plan, not per role or user.
- Dedicated automation accounts: our recommendation is to run integrations from a dedicated, licensed account owned by the platform team, not a staff member's account, and to store its tokens in a secrets manager.
- Content and chat controls: under Security Controls, choose which attachment sources, web content widgets and chat provider integrations are available.
- Token events: Event Reporting records
ACCESS_TOKEN - AUTHORIZE,ACCESS_TOKEN - REFRESHandACCESS_TOKEN - REVOKE.
See the SaaS API Token Security Guide, the SaaS and OAuth App Governance Guide, and, if a token is exposed, the Work SaaS API tokens response guide.
Publishing controls
Owners, Admins and System Admins can publish on Business and Enterprise plans. System Admins can limit or turn off publishing for reports, sheets, dashboards and calendars under Security Controls > Publishing controls.
| Publish option | What viewers get (Smartsheet docs) | Recommended baseline (NHI Mgmt Group recommendation) |
|---|---|---|
| Sheet: Read Only - HTML | Lightweight read-only view, no attachments or comments | Allow with "Same-plan users only" |
| Sheet: Read Only - Full | Read-only view with row attachments and comments | Allow with "Same-plan users only" |
| Sheet: Edit by Anyone | Visitors edit with Editor-level permissions | Turn off unless a named business case exists |
| Sheet: iCal | Sheet dates in external calendars | Allow only where needed |
| Reports | View-only, with attachments and comments | "Same-plan users only" |
| Dashboards | Read-only, refreshed every 10 minutes | "Same-plan users only"; external dashboards reviewed monthly (our cadence) |
| Access: Anyone with the link | No sign-in needed | Off as the default for sensitive plans |
| Access: Same-plan users only | Viewers must log in and be on your plan | Default |
Unpublishing stops the published links and iframe code working. Publishing settings apply to the published link only; direct collaborators keep their own access. For forms, apply the form security settings in Admin Center as well.
Logging and detection
Event Reporting is a premium add-on for Enterprise and Advanced Work Management plans, used by System Admins through GET /events. Calls use either since (for backfill at start-up or recovery, resolved to the hour, ideally paired with to) or streamPosition from the previous response's nextStreamPosition for ongoing collection. maxCount runs from 1 to 10,000 (default 1,000), and Smartsheet recommends gzip or deflate compression.
| Event (Smartsheet event types) | Why it matters |
|---|---|
AUTHENTICATION - LOGIN, AUTHENTICATION - LOGOUT | Sign-in patterns, fallback admin sign-ins |
SHEET - ADD_SHARE, SHEET - ADD_SHARE_MEMBER, SHEET - ADD_WORKSPACE_SHARE (and REPORT, DASHBOARD equivalents) | New external collaborators |
DASHBOARD - ADD_PUBLISH; SECURITY_CONTROLS - ACTIVATE_SHEET_PUBLISHING, ACTIVATE_REPORT_PUBLISHING | New published content and policy changes |
SHEET - EXPORT, REPORT - EXPORT, FOLDER - EXPORT, SHEET - SEND_AS_ATTACHMENT | Bulk data leaving the platform |
POLICY_SAFE_SHARING, POLICY_DATA_EGRESS, POLICY_DATA_RETENTION events | Changes to governance policies |
ACCESS_TOKEN - AUTHORIZE, REFRESH, REVOKE | New integrations and token lifecycle |
USER - SEND_INVITE, USER - ADD_TO_ACCOUNT, USER - DEACTIVATE | Joiners and leavers |
Confirm the current Event Reporting retention window in Smartsheet's documentation and collect continuously so history is held in your SIEM. See the SaaS Audit Log Retention and Licensing Guide.
Metrics that show it is working:
- Share of users on validated domains signing in through SAML (target 100%).
- Items shared with addresses outside the Safe Sharing lists (trend to zero after clean-up).
- Published items using "Anyone with the link", and any using Edit by Anyone (target zero).
- Tokens older than the expiration policy (target zero once enabled).
- Number of System Admins (trend down) and fallback sign-ins per month.
- Export events per user per week against a baseline.
Hardening baseline
A phased rollout. Enabling token expiration and turning off sign-in methods are the two changes most likely to break things, so announce them and test with a pilot group. Most other settings revert by changing the same control.
- Inventory: list System Admins and Group Admins, published items, external shares (sheet access report) and integrations using tokens.
- Validate domains in domain management.
- Configure SAML, set the System Admin fallback with MFA, then turn on domain strict sign-in.
- Turn on the Safe Sharing Policy with allowed domains, approved addresses and a request link; clean up existing outside shares.
- Set publishing controls: "Same-plan users only" as default, Edit by Anyone off, and review existing published items.
- Set content and chat controls to approved attachment sources and integrations, and apply form security settings.
- Announce, then enable API token expiration (our recommendation: 90 days for user tokens), and move automations to dedicated accounts.
- Connect Event Reporting to the SIEM with stream-position polling and alerts on policy and publishing changes.
- Schedule reviews: quarterly admin and token reviews, monthly published item review (our cadence).
| Organisation profile | Priority choices |
|---|---|
| Business plan | Publishing controls limited to same-plan users, content and chat controls, owner briefings on sharing |
| Enterprise | SAML with domain strict, Safe Sharing Policy, token expiration, publishing controls |
| Enterprise with Event Reporting | All of the above plus continuous event collection and alerting |
Common misconfigurations
- Safe Sharing on, old shares untouched: earlier shares remain. Review them with a sheet access report.
- Edit by Anyone left available: turn it off in publishing controls unless a named case exists.
- SSO without domain strict: users can keep other methods. Turn on domain strict for each validated domain.
- No admin fallback, or a fallback without MFA: configure the System Admin fallback and require MFA on it.
- Token expiration enabled without notice: existing tokens expire from their creation date, so warn owners first.
- Integrations tied to personal accounts: use dedicated automation accounts with owners.
Apply Smartsheet's product updates and security notices as published.
Framework mapping
| Smartsheet control | NIST SP 800-53 Rev 5 | NIST CSF 2.0 | ATT&CK technique it helps address |
|---|---|---|---|
| SAML, domain strict, admin fallback with MFA | IA-2 | PR.AA-01 | T1078.004 Cloud Accounts |
| Safe Sharing Policy, publishing controls | AC-3, AC-6 | PR.AA-05, PR.DS-01 | T1213 Data from Information Repositories |
| API token expiration, content controls | CM-7, SA-9 | GV.SC-07 | T1528 Steal Application Access Token |
| Event Reporting to SIEM | AU-6 | DE.CM-03, PR.PS-04 | T1567 Exfiltration Over Web Service |
| User deactivation | AC-2 | PR.AA-01 | T1098 Account Manipulation |
Practitioner checklist
- Corporate domains validated and SAML configured.
- Domain strict sign-in on, with an MFA-protected System Admin fallback.
- System Admins limited to named people, reviewed quarterly.
- Safe Sharing Policy on, with a request link and existing outside shares cleaned up.
- Publishing limited to "Same-plan users only"; Edit by Anyone off.
- Attachment sources and integrations limited in content and chat controls.
- API token expiration set, and automations running from dedicated accounts.
- Event Reporting collected continuously, with alerts on policy and publishing changes.
Standards and references
- Smartsheet: Admin Center, manage security and controls
- Smartsheet: Manage authentication options
- Smartsheet: Configure a safe sharing policy
- Smartsheet: Publish a sheet, report, or dashboard
- Smartsheet: Configure access token expiration time
- Smartsheet Developers: List events
- Smartsheet Developers: Event types
Related NHI Mgmt Group resources: Secure File Sharing Guide, Data Loss Prevention (DLP) Guide, SaaS API Token Security Guide, SAML Security Guide, SaaS Security Guide.