CyberGrant Connector: Encryption for SharePoint and OneDrive

CyberGrant Launches Connector: File-Centric Encryption for SharePoint and OneDrive, No Migration Required

CyberGrant Connector brings file-centric, quantum-safe encryption into SharePoint and OneDrive, inside the Microsoft 365 libraries companies already use. Protection stays with the file after download, sync, and external sharing.

Menlo Park, Calif., September 28, 2026. An authorized employee opens a SharePoint folder, downloads a contract, and syncs it through OneDrive to a home laptop. No policy was broken. From that moment on, though, the document is beyond anyone's control. Verizon's 2026 Data Breach Investigations Report finds a human element in 62% of breaches, and third-party involvement rose from 30% to 48%. IBM's Cost of a Data Breach Report 2025 puts the global average cost of a breach at $4.44 million, plus another $670,000 where unsanctioned AI tools are widely used.

For enterprises running on Microsoft 365, the problem has a specific address: SharePoint and OneDrive. That's where contracts, deal files, and project documents live. And that's where they leave from every day, through downloads, sync, and sharing with vendors and outside counsel.

SharePoint and OneDrive permissions are not file encryption

SharePoint and OneDrive control who can open a file. They don't control what happens to it afterward. Microsoft 365's native encryption protects data at rest and in transit. Once an authorized user downloads a document, that protection stays in the tenant and the file leaves in the clear.

Regulators are noticing the gap. In the EU, the NIS2 directive requires covered organizations to set policies on the use of encryption. In Italy, the deadline for the baseline measures set by the National Cybersecurity Agency (ACN) was October 31, 2026, and auditors now expect evidence that those policies work.

Connector brings file-centric encryption into SharePoint and OneDrive

CyberGrant, a file-centric data protection and data loss prevention company, is launching Connector, file encryption for SharePoint and OneDrive. Connector encrypts files directly in existing SharePoint libraries and OneDrive accounts. Documents stay where they are, with the same file extensions and the same Microsoft permissions: no SharePoint migration required.

Admins choose which SharePoint sites or OneDrive folders to protect. Connector automatically encrypts the files already there and anything uploaded later. Encryption covers Office documents, PDFs, images, design files such as PSD and AutoCAD, source code, and plain text, with original extensions unchanged.

Users keep working in SharePoint and OneDrive with their Microsoft sign-in. Files encrypted by Connector open only on authorized corporate devices. On a personal PC, a file synced from OneDrive or copied from SharePoint stays unreadable.

Encryption keys stay separate from the Microsoft 365 tenant

With Connector for SharePoint and OneDrive, CyberGrant separates custody of content from administration of the Microsoft 365 tenant. SharePoint admins manage sites and permissions, but they can't read encrypted files. In the on-premises version, the encryption keys stay with the customer, on its own infrastructure. In the SaaS version, CyberGrant holds them, separate from the Microsoft 365 tenant.

When a file leaves SharePoint or OneDrive for a vendor, secure external sharing doesn't require adding a new user to the corporate tenant. Whoever shared the document can revoke access even after it's been sent.

Connector for SharePoint and OneDrive is an extension of FileGrant, CyberGrant's platform for file protection and secure sharing. To open encrypted SharePoint and OneDrive documents locally, Connector integrates with RemoteGrant: the decrypted copy exists only in memory.

"Many organizations assumed that managing permissions in SharePoint and OneDrive meant protecting the content. It doesn't. An authorized user can download a document and take it anywhere, and from that point the file is out of your hands. With Connector, we set out to close that gap inside SharePoint and OneDrive without adding complexity: encryption moves into the tools people already use and stays with the document when it leaves the company." Valerio Pastore, co-founder and CTO, CyberGrant

How Connector encryption and Microsoft Purview work together

Connector doesn't replace SharePoint, OneDrive, or Microsoft Purview. SharePoint and OneDrive handle access and collaboration. Purview handles classification, sensitivity labels, and DLP. Connector adds persistent, file-level encryption that follows a document outside the Microsoft 365 perimeter.

In SharePoint and OneDrive, Purview sensitivity labels apply natively to Office files and PDFs. For other formats, Purview falls back on generic protection, which converts the file to .pfile. Connector encrypts any format and keeps the original extension, so an AutoCAD drawing stays a .dwg.

Copilot and other AI assistants that index SharePoint and OneDrive see only ciphertext and metadata in files encrypted by Connector. A confidential document can't feed answers to users who shouldn't be reading it.

Quantum-safe encryption for SharePoint and OneDrive documents

Connector for SharePoint and OneDrive uses the post-quantum encryption built into the CyberGrant suite, based on CRYSTALS-Kyber. In August 2024, NIST published FIPS 203, which defines ML-KEM, derived from Kyber. The threat is known as "harvest now, decrypt later": attackers steal encrypted data today, store it, and decrypt it once a powerful enough quantum computer exists. For long-lived documents stored in SharePoint, such as multi-year contracts, intellectual property, and clinical records, that horizon already falls within their retention period.

[CTA] Explore CyberGrant Connector encryption for SharePoint and OneDrive → https://www.cybergrant.net/en/product-connector

About CyberGrant

CyberGrant builds cybersecurity solutions that protect data, files, and access. Its portfolio includes FileGrant, RemoteGrant, EmailGrant, SecretGrant, AIGrant, and CyberGrant Connector, encryption for SharePoint and OneDrive. The company is headquartered in Menlo Park, California, and works with enterprises and public-sector organizations in industries that handle confidential information. www.cybergrant.net

Media contacts: 

CyberGrant Inc. Press Office
ddl studio, viale Premuda 14, Milan, Italy
Mara Linda Degiovanni | maralinda.degiovanni@ddlstudio.net | +39 349 6224812
Cristiana Freguglia | cristiana.freguglia@ddlstudio.net | +39 339 8739453

FAQ: SharePoint and OneDrive file encryption

What is CyberGrant Connector?

Connector is the FileGrant extension that brings file encryption to SharePoint and OneDrive. Documents stay in their existing libraries, with the same permissions and the same Microsoft interface, and open only on authorized corporate devices. Because protection lives in the file, it holds even after the document leaves the tenant.

Does Connector encryption replace SharePoint, OneDrive, or Microsoft Purview?

No. Connector works alongside SharePoint, OneDrive, and Purview. SharePoint and OneDrive still handle access and collaboration; Purview still handles classification and labels. Connector adds the persistent encryption that follows a document outside the perimeter.

Do I need to migrate files out of SharePoint or OneDrive to turn on Connector encryption?

No. Documents stay in SharePoint libraries and OneDrive accounts. An admin picks an entire site or a single folder, and Connector encrypts the files in that scope. There's no new repository and no permission redesign.

What file types does Connector encrypt in SharePoint and OneDrive?

Any format: Office, PDF, images, PSD, AutoCAD, source code, and plain text, always with the original extension. Purview labels apply natively to Office files and PDFs; for other formats, Purview's generic protection converts the file to .pfile.

Can Copilot read files encrypted by Connector in SharePoint and OneDrive?

No. Copilot indexes SharePoint and OneDrive to answer user questions. In a file encrypted by Connector, it sees only ciphertext and metadata. The same applies outside the tenant: a document that leaves encrypted doesn't feed any AI model.

Is Connector encryption for SharePoint and OneDrive quantum-safe?

Yes. Connector uses CRYSTALS-Kyber, standardized by NIST as FIPS 203 (ML-KEM) in August 2024. It protects against "harvest now, decrypt later" attacks, a real concern for long-lived documents stored in SharePoint.

Does Connector encryption for SharePoint and OneDrive help with NIS2 compliance?

NIS2 baseline measures include policies on encryption, access control, and traceability. Connector applies automatic encryption to SharePoint and OneDrive documents, ties access to authorized devices, and logs every opening, all of which can be documented in an audit. NIS2 compliance, however, is an organizational process no single product covers on its own.

What encryption do large enterprises use for SharePoint and OneDrive?

Large enterprises on Microsoft 365 typically start with Purview Information Protection to classify and label content. Organizations that need to protect documents leaving the tenant, for vendors, outside counsel, or personal devices, add persistent file-level encryption. Connector for SharePoint and OneDrive covers that second layer without a migration.

How do I add persistent, file-centric protection to SharePoint and OneDrive I already use?

Turn on Connector in your existing Microsoft 365 tenant, choose the SharePoint sites or OneDrive folders to protect, and the files are encrypted in place. Opening files in the browser requires no new repository and no end-user installs. Connector integrates with Microsoft Entra ID, so users open encrypted files with their corporate Microsoft account and no new credentials.

Does Connector encryption work with co-authoring, versioning, and Teams in SharePoint?

Yes. Files encrypted by Connector remain compatible with co-authoring, versioning, and Teams, so people working in SharePoint and OneDrive keep collaborating as before. That's a practical difference from Microsoft's Double Key Encryption, which limits collaboration and content processing for encrypted documents in SharePoint.