Updated File Sharing & File Transfer Recommendations
Effective November 2026, our revised file sharing recommendations encourage CU Boulder faculty, staff and student employees to use campus Microsoft services for internal and external file sharing wherever possible and reduce its reliance on Secure File Transfer (formerly Large File Transfer).
The Secure File Transfer (SFT) service will remain available for specific business needs; however, users will only be assigned an SFT license after affirming that Microsoft's file sharing functionality does not meet their data security, proof of delivery or other business needs.
To ensure OIT can continue to offer the SFT service in the face of changing contract terms and rising costs, please update your business practices to limit your team's use of SFT for file sharing.
Overview
Depending on your business needs, CU Boulder offers two primary methods to securely share a file with an internal or external user:
- Microsoft OneDrive or SharePoint – Provides access for the recipient to log in to Microsoft and view or edit the original file.
- Secure File Transfer (powered by Kiteworks) – Sends a secure message with a link for the recipient to log in to Secure File Transfer and download a copy of the file.
Both of the above methods send the recipient a link to the file, rather than attaching a copy of the file to the message.
Secure File Sharing Options
In most situations, we recommend sharing files directly from their online storage location in Microsoft OneDrive or SharePoint.
Depending on the classification level of the content within the file, you may need to apply the appropriate Microsoft sensitivity label to ensure the file is sufficiently protected.
Microsoft OneDrive or SharePoint (Recommended)
Benefits
By sharing a link to a file in Microsoft OneDrive or Microsoft SharePoint, you are:
- Ensuring that recipients are viewing the current version of the file.
- Allowing multiple users to view and (based on your sharing settings) edit the file simultaneously.
- Able to protect the file's contents using Microsoft sensitivity labels (view supported file types).
Limitations
Do not share a file from Microsoft OneDrive or SharePoint if you need:
- Proof of delivery (non-repudiation by the recipient)
- A record of file sharing for possible compliance requirements (e.g., email notifications, report downloads)
- To share confidential or highly confidential data using a file type that's not supported by Microsoft sensitivity labels.
- To share confidential or highly confidential data externally when the most appropriate sensitivity label for that data classification prevents sharing to non-CU accounts.
Your Responsibilities
Before sharing any file, it's your responsibility to protect it against unauthorized access as dictated by its data classification, whether using Microsoft sensitivity labels or another approved method.
Get Started
Current faculty, staff and students are automatically provisioned with Microsoft OneDrive and can request a new SharePoint site or be granted access to an existing one.
- To get started with OneDrive, review our OneDrive pages and tutorials or review Microsoft's OneDrive documentation.
- To get started with SharePoint, review our SharePoint pages and tutorials or review Microsoft's SharePoint documentation.
If you aren't sure whether to use OneDrive or SharePoint for a specific file, see the storage decision guide on our Microsoft 365 - Storage Recommendations page.
Secure File Transfer (Available for Specific Business Needs)
Advanced Features
Secure File Transfer offers the following features that Microsoft OneDrive and SharePoint do not:
- Notices and alerts that files have been shared or downloaded
- Easy status view of files you share
- Proof of delivery (non-repudiation by the recipient)
- A record of file sharing
- Automatic forwarding prevention
- Automatic file expiration after 14 days
Get Started
CU Boulder faculty, staff and student employees are eligible to request an SFT employee license.
To get started:
- Submit a Secure File Transfer Employee License Request (view step-by-step instructions).
- Once you receive an email confirming your access, log in to securefiletransfer.colorado.edu starting on Nov. 10, 2026.
SFT licenses expire each year on June 30. If you still need to send files using SFT, follow the steps above to request a new license starting on July 1.
