Box External Share Audit

Overview

This flow surfaces risky Box file sharing for governance. On a schedule it walks a configurable set of monitored Box folders, reads each folder's items and collaborations, flags open (public) or company-wide shared links and external collaborators, logs every finding to a dedicated Dataverse table, and posts a summary alert to a Microsoft Teams security channel with remediation guidance.

Why it matters: over-shared Box files are a common data-leak vector. Automated daily auditing catches external/open shares and stray external collaborators before they become incidents, and produces a durable Dataverse audit trail for compliance review.

Ships Off (demo).

Use Case

Security and IT-admin teams want ongoing, low-effort visibility into externally shared Box content and external collaborators across the folders that hold sensitive material. Instead of manual periodic reviews, this flow runs every night, records findings centrally, and pings the security channel so risky shares are triaged the next morning.

Flow Architecture

Environment Variables

Connectors & Connections

Connector	API name	Actions used
Box	shared_box	ListFolder
HHTTP	shared_http	GET /folders/{id}/items GET /folders/{id}/collaborations
Microsoft Dataverse	shared_commondataserviceforapps	CreateRecord
Microsoft Teams	shared_teams	PostMessageToConversation

Note — All connections are referenced as solution connection references; the flow is portable between environments as long as a connection is mapped at import time.

Customization Guide

Almost every realistic variant of this flow can be implemented by changing environment variable values. A few cases require small edits inside the flow definition — those are called out explicitly below.

Auto-remediate

Add a Box HTTP PUT (or DELETE the shared link) in the High-severity branch to strip open links automatically.

Owner notice

Add an Outlook SendEmailV2 to email each file's owner about their risky share.

Risk score

Weight severity by folder sensitivity (e.g. a sensitivity column on a folder-config table) instead of access level alone.

Scope tuning

Extend the monitored folder ids to cover more folders; the loop is already sequential and concurrency-safe.

Recurring digest

Add a second scheduled flow that reads the findings table and emails a weekly roll-up by severity.

Key Expressions

The flow is intentionally light on Power Fx / WDL gymnastics — the heaviest expressions are the branch-name concatenation and the approval outcome check. They are listed below in the order they appear in the flow.

and(not(equals(items('Apply_to_each_Item')?['shared_link'], null)), or(equals(items('Apply_to_each_Item')?['shared_link']?['access'],'open'), equals(items('Apply_to_each_Item')?['shared_link']?['access'],'company')))

not(endsWith(toLower(coalesce(items('Apply_to_each_Collaboration')?['accessible_by']?['login'],'none')), concat('@', toLower(variables('varInternalDomain')))))

if(equals(items('Apply_to_each_Item')?['shared_link']?['access'],'open'),'High','Medium')

guid()