U of G's Terms of Use for SharePoint Online

Last Updated: May 11, 2018

Description & Purpose 

Purpose: 
The purpose of this document is to provide the Terms of Use for Office 365 SharePoint (herein referred to as "SharePoint").  This document outlines the roles and responsibilities, policies and processes that guide, direct, and govern the management and operation of SharePoint as a broadly-scoped document management and collaboration platform for the University of Guelph.  

SharePoint is a cloud-based content management and collaboration service managed by Microsoft that is constantly changing. As such, this is a "living" document that will be reviewed and/or updated monthly by CCS.  All users are responsible for ensuring they are up-to-date with the Terms of Use. Users will be made aware when major changes to the Terms of Use have been made.

Scope:
The scope of this document covers all aspects and content within SharePoint Online Site Collection.  

Audience: 
This document applies to any U of G member who is a member of SharePoint, which encompasses faculty, staff, undergraduates, graduates, affiliates, IT consultants, University of Guelph-Humber, and Ridgetown campuses.  This Terms of Use document also applies to external consultants and partners that may have authorized access. 
Policies

University Policies:

All users are required to read and adhere to the following University policies and guidelines: 

 

Appropriate Use:

  • Public-Facing Websites are not permitted. SharePoint is currently for authenticated users only. The University offers a Drupal service, which is the preferred platform for public websites.
  • SharePoint must not, under any circumstances, be used for e-commerce related activities.
  • SharePoint must not, under any circumstances, be used as a learning/course management system as there are campus services in place to fulfill this role.
  • SharePoint must not be used to create alternative business process solutions that are the jurisdiction of another department or that are intended to replace or circumvent an enterprise level solutions (e.g. HR, Student Information System, Financial systems) without the explicit permission and sponsorship of the service and/or data owner.
Microsoft Terms of Use 

All users are required to read and adhere to Microsoft's Terms of Use: 

Eligibility 

While SharePoint can be used by any University member, requests for SharePoint site collections can only be made by faculty and staff with express agreement from the Department/Unit head.  Undergraduate and graduate students are not eligible to request site collections, sites or be granted admin privileges, however they may have Site Member or Site Visitor access. If admin access is required by a student, it must require approval by Department/Unit head.  If a faculty or staff member is requesting a student have admin privileges, they must put in a request via the CCS Help Centre. Student organizations may request sites provided they have received approval from the Central Students Association (CSA). 

Site Member or Site Visitor access can be granted to external users.  External users are users who do not have a U of G Office 365 license, such as contractors, consultants, faculty from other universities etc.  Site Member or Site Visitor access can be granted to specific folders or files within a SharePoint site through “External Sharing” feature, or if there is a need for an external user to have a temporary Office 365 account, they will need to request a sponsored account.  External users must not be granted any admin privileges, only University affiliates should be granted admin access. 
Roles & Responsibilities 

For all intents and purposes in this document:

  • CCS refers to the service owner and administrator of SharePoint.  CCS staff are subject to the same Terms of Use.
  • Site Owner refers to users who have been granted full access to a site collection.
  • Site Member refers to users who have been granted read-write access to a site collection.
  • Site Visitor refers to users who have been granted read-only access to a site collection.

CCS is responsible for: 

  • Configuring and securing the system. 
  • Developing and maintaining any processes associated with the maintenance, monitoring, and security of the system.
  • Provisioning of site collections. 
  • Developing, updating and publishing the governance for SharePoint, which includes this Terms of Use document. 
  • Developing best practices for using SharePoint.
  • Reviewing and installing requests for third-party apps. 

 CCS is NOT responsible for: 

  • Providing, delivering or developing training and/or training material. 
  • Supporting, designing, developing and maintaining solutions within SharePoint. 
  • Managing, creating, editing, deleting, monitoring or maintaining content within SharePoint. 
  • Managing and delegating end user permissions settings within SharePoint. 

Site Owners

Site owners are ultimately responsible for the content on the site and its lifecycle management.  Responsibilities of the site owner include:

  • Reading, understanding and adhering to the Terms of Use (this document), which includes ensuring their site follows the data storage guideline and Acceptable Use Policy
  • Configuring sites to meet user requirements.
  • Managing permissions for their site collection and site(s).
  • Troubleshooting any end-user issues with their site(s).
  • Ensuring that users of the sites are adhering to the Terms of Use (this document), and coordinating with Site Members to address instances of non-compliance.
  • Ensure that the site content is properly maintained over time and properly archived when the site has reached the end of its useful life.
  • Ensure that the site always has an active Site Owner and a backup (if the current owner is going to leave, they must ensure that a new site owner has been appointed).

Site Members

Site Members have control over content, as they may have the ability to add, edit and delete.  Responsibilities of the Site Member include:

Site Visitors

Site Visitors have read-only access to content.  Responsibilities of the Site Visitor include:

  • Reading, understanding and agreeing to the Terms of Use (this document).
Requesting the Service All site collection requests should be submitted through the SharePoint Site Request Form.  Requests will be responded to within five business days.  All other SharePoint requests such as enabling features, quota increases, installing add-ons, etc. should be submitted to the CCS Help Centre.   
Data Retention & Removal

Site Removal
To ensure security and good governance, site owners must regularly review their SharePoint sites to ensure: adherence with U of G Data Classification Guidelines; there are no stale or inactive data; and that user access is still relevant.  Data management and review is an important concept from storage, security and legal perspectives.  If data is never purged, it accumulates, which can be costly in terms of storage, but may also have potential legal ramifications.  

While the University does not have a campus-wide data retention policy, each Site Owner must determine how long to keep the site data, and where applicable, when to delete the SharePoint site and/or data.  This helps to reduce redundant, outdated and trivial (ROT) content. 

SharePoint will be removed under the following scenarios: 

  1. By request from the corresponding department head 
  2. Violation of the Terms of Use - CCS reserves the right to block, restrict or remove any sites found in violation.
  3. After 12 months of inactivity, which is defined by the content not being accessed (read or modified) for 12 months* 

 *Before a site is deleted due to inactivity, the following process will occur: 

  1. After 12 months of inactivity, the Site owner(s) will be sent an initial email detailing this policy along with a warning that the Site will be automatically removed in three months. A specific removal date will be indicated in the email.  Site owners can keep the Site by responding to the email. 
  2. If no response is received to the first email, one month later, a second email warning will be sent indicating the Site will be removed in two months on the date indicated in the first email. 
  3. One month later, a final email warning will be sent indicating the Site will be removed in one month on the date indicated in the first email. 
The Site will be removed on the date specified in the email, and an email will be sent to the Site Owner(s). 
Quota   The University’s licensing agreement with Microsoft for Office365 offers 25TB quota for Teams, SharePoint Online and Project Online for the entire institution.  To strike a balance between distributing quota effectively and equitably while empowering departments to develop solutions to meet their specific needs, CCS will closely monitor usage and institute a ‘soft’ quota of 500GB for each SharePoint site collection, Team Site and Project PWA. 

If a site collection, Team site or PWA exceeds 450GB, CCS will notify the owner that they are approaching their limit.  Depending on available storage, owners may need to purchase additional storage at Microsoft’s current rate ($3/GB/year as of November 2017). CCS will work with owners if this situation arises.
eDiscovery  Electronic discovery or eDiscovery in Office 365 is used to make content stored within Office 365 searchable, such as SharePoint sites.  While the data stored within SharePoint are private, and only accessible to authorized users, users should be aware that data found through eDiscovery can be used in legal cases and security investigations as evidence.  Please visit Microsoft for more information on how eDiscovery is applicable to SharePoint. 
Backups & Restores  

The policies around SharePoint backups, restores and rollbacks are defined by Microsoft’s service level agreement, to which no exceptions or accommodations can be made. Users are encouraged to read Microsoft’s Service Level Agreement on a regular basis to ensure that they are up-to-date on any changes. 

At the time of writing, anything deleted in SharePoint (files, folders, libraries, lists, and complete sites) will go into the “first stage recycle bin”. Each user will have the ability to restore from recycle bin where deleted items will be kept for a maximum of 93 days before being permanently deleted.  If a user empties the “first stage recycle bin” the deleted items will be moved to the “second stage recycle bin”, which only the site collection administrator or the SharePoint administrator has the ability to empty. Whether in first or second stage, anything deleted will only be kept for 93 days in total from date of deletion.  There are no exceptions to this.  

Users can restore deleted items from the first stage recycle bin. Restores from the second stage recycle bin will need to be performed by either the site collection administrator or the SharePoint administrator.

If backups are required of previous versions of documents that have NOT been deleted, users can roll the document back to a previous version if versioning is enabled on a document library.  

This policy only accounts for deletions. It does not cover data corruption, as such it is recommended to backup critical data.
Third-party App Requests  Requests for new third-party apps must be submitted to the CCS Help Centre along with a justification for the request. CCS will review the request to ensure it meets security policies, and determine if there are any unintended impacts to the service or other users.  Additional dialogue may be required if there are associated costs and support requirements. 

Visit U of G's SharePoint Online service catalog page for more information.