Configure Security Controls for an Enterprise Plan

A System Admin for an Enterprise plan can configure security controls to manage the way their users are working in Smartsheet. To get started, select Account > Account Admin, and then select Security Controls on the left panel of the Account Administration window.

System Admins can:

• Set up an Approved Domain Sharing List to prevent sheets from being shared or sent to unauthorized email addresses
• Limit Group Membership Options to only include users on the account
• Choose which Authentication Options are allowed for users
• Enable User Auto Provisioning to automatically add new users to the account if they sign up for Smartsheet using an email address owned by the organization

Set up an approved domain sharing list

Use this capability to restrict sharing by domain or by specific email addresses—for example, use it to ensure that sheets are shared only to people with a company email address. You'll do this by setting up an Allowlist.

When Approved Domain Sharing is enabled, all workflows which only have recipients outside of the Approved Domain Sharing list will become disabled with an "Invalid Recipients" message. To ensure that workflows don't get disabled, make sure that all recipients of workflow automation are added to Approved Domain Sharing. Alternatively, ensure that there is at least one recipient in every workflow within the Approved Domain Sharing list.

NOTES: 

• Users will also be prevented from sending emails from Smartsheet to restricted domains and email addresses.
• Subdomains will need to be added to the Allowlist individually, as they aren't allowed when you add a domain to the Allowlist. For instance, adding "company.com" to the Allowlist will not add "portal.company.com" to the Allowlist as well. (You'll need to add both domains to the Allowlist.)
• When enabled, Approved Domains and Address Sharing capabilities will restrict who can receive notification emails

1. Select Account > Account Admin > Security Controls.
2. In the Approved Domain Sharing section, select Edit.
   
   The Approved Domain Sharing List window appears:
    
3. Select the Enable sharing in Smartsheet only to the domains and email addresses listed below checkbox.
4. In the Approved domains box, type in each email domain (for example: companydomain.com) that users will be allowed to share to.
   
   NOTE: Each domain must appear on a separate line.
   
   If there are any specific email addresses that users should be able to share to that fall outside of the allowed domains, enter them in the Approved email addresses box.
   
   TIP: Provide a link to a form for members of your organization's plan to make a request for System Admins to add additional domains or email addresses to the Allowlist. Your link will be presented in a Smartsheet window whenever users in your plan attempt to share or email an item from Smartsheet to someone whose email address falls outside of the Allowlist. Your link can be: 
   • A URL for an existing system your organization uses (such as an IT ticketing site) 
   • A Smartsheet form (check out our article on Forms for more information)
      
5. select OK.

Once you enable the Approved Domain & Address Sharing capability, people in your account must use email addresses with approved domains when they do the following:

• Share sheets and workspaces
• Send rows
• Use the Send Link to Form option within the form link
• Manually or automatically send OR RECEIVE any alerts or requests (alerts, reminders, update requests, approval requests)

Smartsheet items that were shared before domain restrictions were enabled will remain shared to anyone outside of the approved domains. You can generate a Sheet Access Report to see what items have been shared with whom, details on this are available here.

Modify an approved domain sharing list

To change the list:

1. Select Account > Account Admin > Security Controls.
2. In the Approved Domain Sharing section, select Edit.
3. Select the Edit button on the Security Controls form.
4. Add, edit, remove domains/addresses from the list, and select OK.

To disable the capability, select the Edit button, uncheck the Enabled checkbox, and select OK.

Change group options

Restrict the type of user who can be added to a group by Group Admins. For example, you can limit this to only users on the account or allow all users and external contacts in groups.

1. Select Account  > Account Admin > Security Controls.
2. Click Edit in the Group Membership Options section.
   
   The Group Management Options window appears:
    
3. Select whether to have group membership Limited to Account Users Only. When this option is selected, only users shown in the User Management screen can be added to groups by Group Admins.

To learn more about creating and managing groups, see the Managing Groups help article.

Manage authentication options

All Smartsheet customers can log in using their email address and Smartsheet password or they can choose from a number of single-sign on options. System Admins have the ability to disable any of these log in options as desired.

Learn more about this in the article Manage Authentication Options for an Enterprise Plan (System Admin).
 

Enable user auto provisioning

User Auto Provisioning automates the process of adding users to an Enterprise account in Smartsheet. Rather than manually inviting users through the User Management screen, enable this capability to automatically add users to your account if they sign up for Smartsheet with an email address owned by your organization. You can choose to automatically add users to the account as licensed or non-licensed, depending on the access you'd like to provide.

Review our help article on User Auto Provisioning for detailed instructions. Completing the process will require you to add record(s) to your Domain Name System (DNS), so you may need to loop in an internal technical resource for assistance.