Offered by UBC as part of its Microsoft Office 365 subscription, Microsoft OneDrive and Teams are tools available to UBC staff, faculty and students, to facilitate and support collaborative work and allow for safe information storage, sharing, and management. This page provides information about what researchers should consider when using these tools for research.
Before reading this page
It is recommended that researchers consult an information security professional when planning a research project that will collect, process, store, and/or share research information. This page covers high-level concepts about information security and may not include all information applicable to specific research projects.
For assistance, please contact arc.support@ubc.ca
Microsoft Teams
Microsoft (MS) Teams is a collaboration tool for groups to create content and share the information they need to work together. The tool is operated by Microsoft as part of their MS 365 suite. MS Teams enables users within the University to connect via instant messaging, video conferencing and online meetings while simultaneously working together on a document in real-time.
Researchers can use MS Teams to collaborate on research related documentation and store research information, as well as perform administrative tasks such as scheduling, developing protocols and planning.
Microsoft OneDrive
Microsoft (MS) OneDrive is a file hosting and synchronization service operated by Microsoft, as part of their suite of MS 365 applications. MS OneDrive allows users to securely store, share and synchronize files and folders from anywhere at any time.
MS OneDrive was deployed as a storage solution for UBC Electronic Information, including research information.
Microsoft SharePoint
SharePoint is a cloud-based information management system that allows organizations to store, share and manage content across multiple platforms. SharePoint is the infrastructure that manages both OneDrive and Teams.
Considerations when using UBC OneDrive and Teams for research
Information Security
Use of the UBC Microsoft Teams and OneDrive is subject to UBC Information Systems Policy (SC14) and associated standards. Users and data stewards are responsible for taking appropriate precautions to protect information stored in Teams and/or OneDrive. Research ethics applications must also include the details of data storage, both while data is being collected and after publication.
OneDrive and Teams Security Considerations:
Consideration | Teams | OneDrive |
---|---|---|
Access Management | By default, all users with access to a Teams channel or group can view, modify and/or delete content. For this reason, researchers should use caution when adding users to Teams, and avoid posting/storing information that is not needed by all users. | Data stewards have the ability to define user access and permissions in OneDrive. Appropriate measures should still be taken to ensure access is granted and removed, based on the Principle of Least Privilege. |
Desktop Application | All Files stored using Teams reside in the Microsoft Cloud. By default, Teams is not configured to access files when not connected to a network. | The desktop OneDrive application will locally store a copy of any files/folders a user has access to. Appropriate precautions should be taken to ensure sensitive information is protected from unauthorized access. |
Want to learn more about UBC information security requirements?
Visit: cio.ubc.ca
Information Storage
While Microsoft Teams and/or OneDrive are generally suited to store research information of all classifications, it is important for data stewards to ensure the information is properly safeguarded based on its classification.
Information Classification
Information classification (also known as data classification) is a crucial step in building a research projects’ security posture. It identifies the safeguarding requirements that should be in place for the project to be compliant with the university policies.
To identify information classification:
- Consult UBC Information Security Standard U1(ISS-U1) and our Research Information Classification page;
- Review the nature of the information;
- Identify the elements collected, processed or stored that meet the highest risks in ISS-U1;
- Assign an Information classification to all research information based on the results of step 3.
Note
Regardless of the amount of information collected, processed, stored, or shared, the most sensitive element identified should be the one defining the overall information classification.
Information management, access and security considerations
Information type | Information classification per UBC ISS U1 | Considerations |
---|---|---|
Administrative information | Low | Non-confidential administrative research information can be safely stored in Teams or OneDrive. |
Administrative information of sensitive nature | Medium | Access to administrative information of a sensitive nature should be limited to authorized users only. |
Non-proprietary and/or non-regulated research information | Low | Non-proprietary, non-regulated, and/or research information of a non-confidential nature can be safely stored in Teams and/or OneDrive |
Proprietary and/or regulated information | Medium | Before storing this type of information in Teams or OneDrive you should ensure that the tool(s) meets the requirements of the associated regulations, notably: Data residency, access control, and safeguarding. |
Information subject to terms of use, custody or sharing agreement | All classifications | Before storing this type of information in Teams or OneDrive you should ensure that the tool(s) meets the requirements of the associated agreement(s), notably: Data residency, access control, and safeguarding. |
Personal information, and personally identifiable information | High; Very-High | It is recommended that files including personal information and personally identifiable information be password protected or encrypted at file level. Before finalizing your research participant consent forms, determine where your research data will be stored. |
Information Storage FAQ
My research information is very valuable to my research project, but is not classified as High or Very-High risk; can I still apply the highest safeguarding requirements?
Yes, while the information classification above is modeled on severity and impact, other risks such as loss of data could result in a researcher applying a High Risk classification to their research information. Based on your information classification, you must apply the security requirements of UBC Information Security Standard U7 (ISS-U7); but it is also recommended to apply higher security controls to any valuable information, regardless of their classification.
What if my information classification changes?
If your information classification has changed, you should adjust safeguarding measures to meet the requirements of the new information classification. Note that, per Information Security Standard U1 (ISS-U1), classification can go up (e.g.: from Medium to High risk), but not down (e.g.: from Medium to Low risk).
Should I encrypt my information?
File level encryption is recommended for files containing personal information, personal identifiable information, as well as any confidential files who requires restricted access.
Note: You may be required to encrypt information if it is subject to a specific regulation, agreement, or 3rd party requirement.
How long should information be stored using these tools?
UBC OneDrive and Teams storage are available as part of an agreement between UBC and Microsoft, and will be available for the duration of this agreement (or its extension, where applicable). However, note that access to OneDrive and Teams are contingent on your affiliation with UBC; if you leave the institution, you will lose access to your files. Depending on the nature of your research information, UBC has dedicated repositories for the long-term storage of research information.
For guidance on long-term storage options (archiving or data preservation) and to meet the requirements for retaining research data for a minimum of 5 years after publication, contact:
UBC Vancouver: research.data@ubc.ca
UBC Okanagan: csc.ok@ubc.ca
Can I use Teams and OneDrive to archive information?
Teams and OneDrive are intended to be used for active storage and are not recommended for information archival. Furthermore, information stored in Teams will be automatically purged after one (1) year of inactivity on the platform. Visit our UBC Research Storage Finder page for alternate storage options or contact arc.support@ubc.ca to schedule a consultation with one of our subject matter experts.
Can I recover deleted information in Teams and OneDrive?
Deleted files will be kept in the recycle bin for a maximum of 90 days, after which they will be permanently deleted from the cloud, and will not be recoverable.
Additionally, OneDrive and Teams allow the recovery of a certain number of versions for a specific file. Visit the Microsoft Support knowledge base to learn more about this feature.
Will my information be backed-up?
Microsoft Teams and OneDrive do not undergo regular backups. If you store valuable or regulated research information, it is recommended that you keep a recurring backup copy of the information outside OneDrive/Teams.
Note: There is no reason for concern about accidental data loss due to the redundancy built into the architecture.
Are there other storage options available at UBC?
If UBC Microsoft Teams or OneDrive are not suitable for your research project, some alternative storage solutions are offered by UBC and other service providers. For more information about these alternatives, visit our UBC Research Storage Finder page or contact arc.support@ubc.ca to schedule a consultation with one of our subject matter experts.
Information Sharing
Microsoft Teams and OneDrive allow information to be accessed and shared with external collaborators (non-UBC users).
Information Sharing Guidance
Use Case | Teams | OneDrive |
---|---|---|
Access Control | Only Team owners have the ability to invite external collaborators to a team/channel, and may limit guest-user permissions. | Only the OneDrive folder/file owners have the ability to allow external collaborators access, using the OneDrive web-application. |
Desktop/mobile Application | External collaborators will be able to install and use the Microsoft Teams application with limited capabilities. | External collaborators will not be able to access shared folders/files using the OneDrive desktop/mobile application. Instead, they will have to use the web platform and identity validation will be required every time they access the shared OneDrive location. |
Collaboration | External collaborators will be able to collaborate on files to which they were provided access, in real time via the Teams desktop, or web application. | External collaborators will be able to collaborate on files to which they were provided access, in real time, only via the OneDrive web application. If the external collaborator requires frequent access to files, it is recommended to share it via Teams instead of OneDrive. |
Information Sharing FAQ
Can non-UBC users access OneDrive or Teams without a Microsoft Office license?
Yes. When a file or folder is shared, users can use the OneDrive or Teams web-application available through most browsers.
What is the best way to share information using UBC OneDrive?
We recommend using the OneDrive web-application to share information, as the interface has comprehensive settings and is design to prevent incidental sharing.
What is the best way to share information using UBC Teams?
We recommend using the “Files” tab of the Teams desktop or mobile Application has comprehensive settings and is design to prevent incidental sharing.
Can I limit access to shared files on UBC OneDrive and Teams?
Yes. As the file (or folder) owner, you may decide whether users will have read/write, or read-only access when sharing.
Can I share sensitive information through UBC OneDrive and Teams?
Yes. UBC has approved UBC OneDrive and Teams to store and share information of all classifications. However, it is recommended to password protect (or encrypt at file level) files containing information of sensitive nature that will be shared outside the organization.
Information Processing
Microsoft Teams and OneDrive have limited functionality for information processing as their sync functionality may interfere with running processes.
Information Processing Guidance
Use Case | Teams | OneDrive |
---|---|---|
Collaboration using Microsoft Office Applications | Teams is specifically designed to allow real-time collaboration on files using Microsoft Office Applications. All Teams users can use the built-in engine to quickly update files such as Word documents, Excel spreadsheets, PowerPoint presentations and more. | Files can be opened using Microsoft Office web-applications and updated in real time (no latency; works well for collaborative editing). Files can be opened using Microsoft Office desktop applications and updated as OneDrive syncs (low latency; possibility of editing conflicts being introduced). |
Processing and BI Engines | Teams is a purely cloud-based application and does not allow the use of data processing and BI engines with UBC’s current implementation. | Because of its sync functionality, Microsoft OneDrive may interfere with data processing and BI engines.
|
API Connections and Custom Apps | Teams is a purely cloud-based application and does not allow the use of API connections and custom apps with UBC’s current implementation. | |
Use the tool as a Database | Teams and OneDrive are not intended to be used as, or to host databases with UBC’s current implementation. |
Privacy Impact Assessment
OneDrive and Teams had a Privacy Impact Assessment (PIA) completed for use by UBC staff, faculty, and students, and within the UBC environment. If you intend to use UBC Microsoft OneDrive and/or Teams outside the UBC environment (e.g. in a Health-Authority), please consult the information owner first to ensure all privacy and security requirements are met by these tools.
Note: The use of Microsoft OneDrive and Teams for research administrative tasks and information storage is not specifically mentioned in the current PIA, but is implied within the analysis conducted by UBC. For more information about the UBC PIA process, visit: privacymatters.ubc.ca/pia-process-overview.
Additional Resources
To learn more about UBC information privacy and security, visit:
To learn more about UBC security requirements, visit:
Office of the Chief Information Officer
To learn more about UBC Microsoft Teams, visit:
To learn more about UBC Microsoft OneDrive, visit:
Can’t find what you are looking for?
Send us an email at arc.suport@ubc.ca to talk to one of our subject matter experts.
Need technical support for OneDrive or Teams?
For technical questions regarding OneDrive or Teams, please contact the UBC IT Service desk.