As you can imagine, the security model for Experience Cloud access may need to be drastically different than what you have for your internal users. sFiles for internal users is designed to have each Salesforce user correspond to a SharePoint user and therefore all interactions with sFiles will be done as the corresponding users. sFiles for Experience Cloud however, is generally implemented so that all Experience Cloud users access SharePoint as a single user (this is not required but is generally implemented). This single user would then need access to all of the folders that Experience Cloud users will require in order to perform their tasks.

This means that a single shared SharePoint user account needs to be only as permissive as is absolutely necessary. Here are some guidelines:

• NEVER use an admin-level account for the Experience Cloud SharePoint user.  
• Try to avoid open enrollment of Experience Clouds or immediate activation of new users. Open enrollment with the ability to upload files does present a tempting DOS or upload attack for hackers.
• Uploads can be done with the sFiles upload component, but there are limitations with this simple component. If you need additional functionality, use the sFiles API to further control where the files are allowed to go in SharePoint. (Many scripting options are available. Ask us about options.)
• Do not use sFiles in Experience Cloud for Personal Data when the SharePoint user account is shared by multiple Experience Cloud users.
• If possible, tie Experience Cloud users to actual SharePoint users. This avoids the shared account issue.
• Lock down available functions at the SharePoint Object Settings metadata level to prevent a user from doing things they should not be able to do.
• Make sure that you have your IT security team review and test your implementation to make sure you haven't missed anything.
• Go over your design with the sFiles team to see if there are additional best practices to follow.

Any Experience Cloud requires vigilant security planning. With reasonable care, a very high level of service can be offered to your customers or partners by implementing the sFiles toolset for Experience Cloud.