Privacy supplement for Microsoft SharePoint Workspace 2010

User account file

Every user of the SharePoint Workspace software has an account file (user account) that contains required information, including the user's identities, secret encryption and signature keys, a list of devices on which they run SharePoint Workspace, a list of known workspaces, and a list of known contacts. A user’s identity might be managed or unmanaged. Managed identities are created and controlled by an administrator by using either a SharePoint Workspace Manager server or Microsoft SharePoint Workspace Enterprise Services (SharePoint Workspace Enterprise Services). Unmanaged identities are created by users and not controlled by an administrator. A user account might include both managed and unmanaged identities.

The SharePoint Workspace software uses Globally Unique Identifiers (GUIDs) to identify user accounts (user account GUID), and user identities (identity GUID) within accounts. GUIDs are generated using random numbers, no part of which is derived from your information or your computer’s context. The use of GUIDs facilitates communication among SharePoint Workspace software users by uniquely identifying them to one another, even when the name, IP address, or other information associated with their SharePoint Workspace account or identities changes. The SharePoint Workspace software also uses GUIDs to identify computers or devices (device GUID) on which the software is used. GUIDs and IP addresses are required for the correct operation of SharePoint Workspace software and cannot be disabled.

You can review and edit your personal information by clicking the File tab, clicking Manage Account to open the Preferences dialog box, and then clicking Edit on the Identity tab. You can delete your account by clicking the Accounttab in the Preferences dialog box, on the Options menu and then clicking Delete.

Information in workspaces

Microsoft does not access your SharePoint Workspace. All SharePoint Workspace content that leaves your computer or device is encrypted, including data temporarily stored on the SharePoint Workspace Relay 2010 servers. The encryption keys are kept on your computer or device and are not accessible by Microsoft unless you use the optional managed identity features provided by Microsoft. Microsoft does not use these encryption keys to access your data, except as described in this statement.

Using hosted servers

Your administrator can configure SharePoint Workspace to use relay and manager servers owned and operated by Microsoft, your enterprise, or a third-party. Those servers collect your IP addresses and GUIDs associated with your computers and user accounts.

Before you can use any Microsoft manager or relay server, SharePoint Workspace sends your user account GUID, your computer’s time zone, your computer’s regional and language settings, the type of your Microsoft Office license, and some cryptographic information to the global provisioning service. The global provisioning service identifies the manager and relay servers to be used by your account and sends your product ID and user account GUID to the manager server.

Managed identities on a hosted server

If your identity is managed on servers hosted by Microsoft or a third party, those servers have your contact information, policy settings for your identity and devices, a backup copy of your account, and statistics on your SharePoint Workspace usage. If authorized through role-based access control settings, your domain administrators have access to this information. Examples of the types of statistical information that SharePoint Workspace collects include the following:

• Number of invitation acceptances and rejections.

• Number of chat and Instant SharePoint Workspace messages sent.

• Number of permanent or temporary workspaces created or deleted.

• Number of members in workspaces.

• Number of tools created and deleted.

• Amount of time spent in workspaces, using a particular SharePoint Workspace tool or feature, and using the SharePoint Workspace software alone and with other people.

• Edition and version of the SharePoint Workspace software that you use.

• Use made of our automated Help features.

Microsoft collects aggregate usage information from hosted servers, but does not use your domain information in a manner that personally identifies you, except to provide automated SharePoint Workspace services to you, such as relay services, and with your consent for purposes of providing you support.

Creating an account

When you create an account, SharePoint Workspace collects your full name and your e-mail address. This required information, along with other information, for example, phone numbers, mailing address, entered by you or your administrator, is stored on your local computer. It is added to your contact and visible anywhere your contact is available, for example, to other members of your workspaces.

Account access reset for unmanaged identities

When you enable automatic account access reset, your e-mail addresses are sent to a SharePoint Workspace Manager server operated by Microsoft, along with your identity URL and user account GUID. Some additional non identifying data is also sent to ensure that a future request to reset your account access matches your account. This information does not give Microsoft access to your data.

Requesting an automatic access reset for unmanaged identities

If SharePoint Workspace requests an access reset on startup, your e-mail address and display name are transmitted to a SharePoint Workspace Manager server, along with your identity URL, user account GUID, and encrypted secret encryption keys for your account. This information is only sent to Microsoft if you are using a SharePoint Workspace Manager server operated by Microsoft. In response to this request, you receive an e-mail message that contains a temporary password. Use of the automatic access reset feature is optional.

Using the public SharePoint Workspace directory

If you choose to list your name or other contact information in the public SharePoint Workspace directory, your contact is stored on Microsoft servers. The public SharePoint Workspace directory, accessible through the SharePoint Workspace software, is available to everyone on the Internet. Anyone with access to the public SharePoint Workspace directory can find and use your contact, giving them access to business and personal data within your contact and giving them the ability to use SharePoint Workspace to perform operations, such as monitor your presence status, send you instant messages, and invite you to workspaces.

Publishing your name or contact information in the public SharePoint Workspace directory is optional. You can retract publication of your contact information by changing each of your identity’s Public SharePoint Workspace Directory listing preference to No Listing, but you cannot retract your contact from anyone who already has it. To change this setting, do the following:

1. Click the File tab.

2. Click Manage Account.

3. Click Account Preferences.

4. Click the Identities tab.

5. Change the List me in setting to No Listing.

That is, after a recipient has your contact, they can continue to receive updates when your contact changes and be able to use it to send you messages.

If you choose to search for contact information for a SharePoint Workspace user, for example, to add the user to your contact list or to invite the user to a workspace, the input search text is sent to a SharePoint Workspace server hosted by Microsoft.

Using a network directory

If you choose to list your name or all contact information in the local network directory, your contact is stored on other computers that are running SharePoint Workspace that are within the same network segment and able to receive SharePoint Workspace’s network broadcast messages. If your computer is directly connected to the Internet, the computers that can have your contact depend on the network configuration of your Internet service provider. Similarly, if you share a connection to the Internet, for example through a wireless network access point in an Internet “hotspot”, other computers using the same connection and running SharePoint Workspace receive your contact. Anyone who searches the local network directory can find and use your contact, giving them access to business and personal data within your contact and giving them the ability to use SharePoint Workspace to perform operations, such as monitor your presence status, send you instant messages, and invite you to workspaces.

Publishing your name or contact information in the local network directory is optional. You can retract publication of your contact information by changing each of your identity’s Local Network Directory listing preference to No Listing, but you cannot retract your contact from anyone who already has it. To change this setting, do the following:

1. Click the File tab.

2. Click Manage Account.

3. Click Account Preferences.

4. Click the Identities tab.

5. Change the List me in setting to No Listing.

That is, after a recipient has your contact, they can continue to receive updates when your contact changes and be able to use it to send you messages.

Using contacts

If you choose to add a contact for someone to your personal contact list, your identity contact is sent to that person. Your identity contact contains your name, public encryption keys can be used to identify you and a list of client and relay devices you use.

When you import your user account onto a new device, identity contacts for every identity within your account will be sent to and stored on the computers used by everyone identified in your account. This includes all users contained in your personal contact list and all members of all spaces in which you are a member. Recipients of your identity contact receive updates whenever information in your identity contact changes. They also receive contact information for all identities in your account.

When you choose to accept a workspace invitation, send an instant message, invite someone to a workspace, or send your exported contact file to someone, the recipient receives full contact information for your identity, including all vCard fields, such as your name, address, and phone numbers.

Top of Page