Corporate Drive Best Practices
Overview
The Seeq Corporate Drive is a convenient way to share and govern your content across large Organizations without the need to individually apply sharing permissions. Below are a few best practices we have collected from our customers who leverage the Corporate Drive.
Shared vs Corporate Drive
The “Shared” section in a user account displays Seeq items that are shared with a user via the “Share” menu. It does not organize the items in a specific manner other than which user shared the item. For larger organizations, this can become limiting as more content is shared with multiple users. If a user departs or changes the organization, access control on each shared item has to be updated to reflect who has access.
In contrast, the Corporate Drive is a centralized location that allows sharing across the Organization independent of the user who “owns” the content. Content placed in the Corporate Drive is generally intended to be shared with a number of users who require access.
For long lived access of items that are commonly shared in an Organization, it is recommended to store items in the Corporate Drive.
Access to items in the Corporate Drive is managed via Seeq’s Access Control system as outlined below.
Access Control
By default, the Corporate Drive is available with Read/Write/Manage access to members of the “Everyone” group. The intent is to easily share content and set up folders in a centralized manner without having to request additional permissions. This means that any user can place items and create folders at the root of the Corporate Drive.
If a user tries to change the permissions on an item or folder via “Manage Permissions”, they may find the option to remove or change “Everyone” greyed out. This is because, by default, the permissions are inherited from the parent folder/drive. Provided the user has “Manage” permissions, permission inheritance can be disabled by selecting the “Advanced” tab and clicking the “Disable permission inheritance”.
Removing inheritance decouples the permissions from the parent folder, allowing the user to change or remove who has access, including the “Everyone” group.
To completely exclude certain authentication sources from the “Everyone” group (and thus the Corporate Drive), refer to this Knowledge Base article.
Users and Groups
Seeq supports both Users and Groups (collection of Users) for access to Seeq items. A good practice is to leverage Groups to manage access to subsets of the Corporate Drive. This handles access control for the right users even as they change roles in the Organization.
Groups can be configured via the Seeq Directory or synchronized from the customer authentication source (recommended). Refer to this article on how to configure and manage Groups.
A Group can be assigned access to Seeq Items in the same way a User can and therefore is a convenient way to assign/remove access in bulk.
Organizing Content
Content in the Corporate Drive is organized like files in popular computer operating systems.
Folders
Seeq uses folders to group content in a hierarchical manner. When an item is created or placed in a Seeq folder, by default its permissions are inherited from the parent folder/drive as described above. Once a folder’s permissions are set, any item placed in that folder will inherit those permissions unless manually changed. This allows for easy sharing with stakeholders in the organization.
A good practice is to establish hierarchies with folders in the Corporate drive that meet your business requirements. A few examples:
Business Unit / Facility / Operating Area
Region / Customer
Function / Site / Unit
A dedicated “Admin” folder may be helpful to manage a collection of Items/Scripts used by Administrators. By removing permissions for all users, only Admin users will be able to view these items.
Each customer may have different needs and priorities on how information is shared across an Organization. A good litmus test on how to structure the data is to assess which users or group will benefit from read/write/manage and leverage permission inheritance to ensure proper access for each user.
It is generally recommended to not store items (other than Folders) at the root level of the Corporate Drive as it will quickly lead to clutter.
Naming
By default, Seeq will name analyses and folders {Item} {Date}. In the Corporate Drive especially, it is highly recommended to rename Analyses and Folders from their default name.
Customers generally apply names that are descriptive of the Analysis or Topic. If an item is work in progress, customers may opt for appending a Draft suffix to indicate its status. Drafts can of course be created in a user folder as well and moved to the Corporate drive when ready for sharing. Permissions will be inherited according to the destination folder.
An optional description can also be added by clicking the three dot menu next to the file and selecting “Edit”.
Renaming or Moving Items
Items created in Seeq are assigned a unique ID which is included in shared links. If a link to an item was previously shared and then moved or renamed, it will still work provided the recipient has the appropriate permissions to access it.
If an item is moved into a folder with restricted permissions, it will inherit those permissions. In such situations, it is recommended to confirm the folder has the appropriate user/group permissions.
Document Control
Controlling Analysis Changes
To avoid accidental modification to Seeq content, it is recommended to limit “Write” or “Manage” access to a limited set of Users or Groups. Users with “Read” access are able to view and navigate content without modifying the underlying analyses. Users with “Write” or “Manage” access, will be able to modify content. See the Access Control section on how to manage permissions.
If it is desired to completely lock down an analysis from any changes, refer to https://support.seeq.com/kb/latest/cloud/locking-a-workbench-analysis .
Backups
Seeq’s database is automatically encrypted and backed up on regular intervals by our cloud providers. Refer to https://trust.seeq.com/?itemUid=bea8aecb-dacd-4871-bb86-7195d2427002&source=search for details. Since this is a backup for the entire database, it will be a manual (slow) process to recover a single analysis.
For this reason, for critical items located on the Corporate Drive, a best practice is to either Lock or periodically Duplicate the item to preserve its state.