Never share publicly option in AGOL

[MelanieWawryk]

I would like to have a never-share publicly option similar to the delete protection but one that can only be edited by administrators. There could also be a global setting that always sets the flag to on or off. It could then be used as a gatekeeper for AGOL objects to be approved for public use.

We have layers that are used in apps that require a staff sign in but the layers sit in AGOL and can be shared inadvertently often when an app won't work and it is shared which shares the layers in it. 

[MikeMinami]

There is a global setting for this that an administrator can set on the Organization tab that restricts members from sharing items publicly. See this help topic.

https://doc.arcgis.com/en/arcgis-online/administer/configure-security.htm

Members can share content publicly—Enable this option to allow members to make their profile visible to everyone (public), share their web apps and other items with the public, or embed their maps or groups in websites.

[MelanieWawryk]

@MikeMinami We need it at the feature and app level. Some layers we have available externally for staff use, what we want to prevent is those layers from inadvertently being shared publicly. At the same time, we have lots of other layers that can be shared publicly so we don't want to restrict people from sharing anything publicly

[Will]

Another approach could be to create a custom role for your org that disallows public sharing, then you can use that role for all users except for those (admins, etc.) that need public sharing.  I think one issue with custom roles though is that Esri periodically releases new role functionality, so periodically you might need to review your custom roles to see if additional functionality might need to be added.

[StephanieBucknam]

Chiming in to agree- we need this on an item level, not just via user roles. And in Enterprise. As a GIS administrator it is too easy for staff who are appropriately given public publishing access to accidentally share items that should never be made public. Individual items can include PII or any other confidential information, so regardless of User Roles, it is an important security feature that there should be a setting to prevent individual item from ever being made public.