Media2URL
Workspace based file access

Private links for files that should stay inside your workspace

The URL to access a file is sometimes insufficient to grant access. For example, a team draft, internal PDF or client project may need to be shared with multiple individuals that are part of the same Media2URL workspace.

Private access is designed to accommodate this type of scenario. When the user opens the link and logs into their account, Media2URL verifies if they have permission to view files within the same workspace as the file.

The URL being sent to an individual outside of the workspace doesn't provide them with the same level of access as those inside the workspace.

Create a Private LinkReview private link plan options
The workflow

The file belongs to a workspace, not just a URL

Private sharing begins with the owner of the resource's workspace. That's how it differs from a non-public URL (unlisted link). Normally, simply knowing the active URL will allow you to access the resource.

With Private access, the link and the signed in account are checked together.

  1. Step 1

    Put the file in the workspace that should control it

    A client file should be stored in the client workspace when access must be managed there. Similarly, an internal team project or your own workspace can also use this model. Your decision to store the file in the correct workspace is critical since Private access will follow the workspace in which you have stored the asset. If you store the file in the incorrect workspace, you will have its access controlled by the incorrect group of members.

  2. Step 2

    Change the file access to Private

    When you open the file settings, select "Private" if possible. From there, knowing the URL will not be enough to allow someone to view the content of your file. They must be logged into their Media2URL account and have access to the workspace where the file was created.

  3. Step 3

    Send the link normally

    You may email a link of the file to a person that will require the use of the file. As soon as the user opens the emailed link, Media2URL verifies the user's permissions on their account instead of assuming that simply because you sent them the link they are authorized to access the file. This allows for files accessed through links to remain tied to the same membership the rest of the team uses if the user is already part of the project workspace.

  4. Step 4

    Access can change later

    Projects are not always static. A project can lose a contractor, a review is complete, or an individual's workspace role changes. A workspace administrator with permissions can either delete that member or modify their access rights as appropriate. The file link can be turned off independently, and neither of those actions automatically deletes the stored asset.

How Private access works

The URL is only one part of the permission check

A Private Link continues to use a standard URL, however, that URL alone does not provide full access to the file.

The recipient must also sign into an account that is authorized to view the workspace containing the file. When an authorized user sends the exact same URL to a non-workspace member, the forwarded link does not give the non-workspace member permission to join the workspace.

This makes Private access useful when permission should follow an existing team or project relationship. Access stays connected to the workspace rather than spreading to anybody who happens to receive the link.

Access comparisons

Public, Unlisted, password protected and Private links behave differently

Link modeWhat gives someone access
PublicA working URL
UnlistedPossession of the working URL
Protected by a passwordThe URL and the required password
PrivateThe URL and authorised signed in workspace access

Public and Unlisted links can both open as long as you have the right web address. Since an unlisted link doesn't ask for a login or password, you shouldn't use an unlisted link if you want to limit access to your content.

Currently, Media2URL has noindex tags on both types of share pages (private and public). Using "Unlisted" will not create another search index tag; however, using noindex tags does not prevent users from accessing the content if they have the link. To control access to content requiring access verification, use either "Private" access or password protection, depending upon what features are available with your plan.

Password Protection is handled differently. The recipient of the link will provide proof that they have access to the link by providing the same password that you are using to protect the link rather than being a member of your Media2URL Workspace.

Private access is useful when the people are already part of the project

Suppose there were five individuals employed in the same office. In addition to managing user access through your organization's existing membership system, sending a new internal file access password to each of those individuals every time they require access to an internal file would create a second method for accessing files within the organization.

By using private access, it allows for a simpler connection. A user will sign in with their own account, and once signed into their workspace, they have access to all of the files within that workspace.

When a member of your team leaves, it will be much easier to remove them from the project. Their removal from the membership list will change how they can use the workspace after they have left. This means you do not have to recall all of the passwords they were given during their time on the project.

A password can be a better fit for somebody outside the workspace

Not every person who receives your email will be added as a workspace member. For example, if you have a client that only wants to view a single draft of a document, they may not need to be able to access the other parts of the workspace.

In this case, it is more appropriate to use a control such as a password protection or an expiration control if these types of controls are offered. A person will gain access to the file with no other reason than to review it for a brief period of time and will not be added to the workspace.

A public website image provides a good illustration. The use of private settings will prevent the exact group that the page was created for from accessing the asset, should those who access the site anonymously require the download.

When you are enforcing permissions that relate to the workspace members, private works better.

Workspace roles and Private access are related, but they do different jobs

Roles of a person in Team Workspaces may include: Owner, Admin, Editor and Viewer. Each role determines what that individual can do within the workspace. When a user signs into their account, private file access determines if they belong to the workspace that contains the file. Therefore, even though two users are able to view a Private file, they will likely differ in how much control they have over the organization, editing or management of the content in the workspace.

Forwarding the URL does not forward the workspace membership

When a authorized member copies a private link and sends it to someone else, this doesn't guarantee the other individual has the same permissions. If the person being sent the link has no authorization to view the workspace that owns the link, the fact that they now have the URL itself doesn't provide them with the right to access the private link. This is also another practical limitation. Since individuals with authorization to access content can copy or download what they're authorized to see; therefore, private access shouldn't be used as a method to prevent authorized viewers from copying the information.

Private access can also have an end date

Workspace membership answers who will have the ability to view/edit this file. Expiring Links answer how long you want the link to remain valid. Both can work together depending upon what features the file and your account currently support. A project member can be given permission to access the file for a specific time frame, and when the deadline passes, the sharing link will no longer function, preventing the file from becoming available publicly. This combination works well when the people involved are trusted members of the same workspace and need to use the file for a short period of time.

Removing a member does not remove the team's file

Suppose a designer uploads product images to a shared client work area. After a month, the designer departs from the project.

Removing the designer's membership will affect how they can use the work area going forward; however, it will not necessarily remove the images in the team's shared library.

The stored asset has its own life cycle within the Media Library. Decisions about who has access to a workspace and whether to delete a file are made independently.

One file can stop being shared without changing the whole team

The workspace may be available and all users will continue to be members of the workspace. However, an old draft document cannot be accessed using its prior URL.

By disabling access to the old draft via its URL, you are handling the single asset. It is not necessary to delete members of the project simply because a file should no longer be delivered.

The underlying asset can also remain in the library if the team continues to require it internally.

Choosing an access mode

Start with what the recipient actually needs

SituationUseful starting point
An image needs to load on a public websitePublic
Only people who receive the URL should know about the fileUnlisted
An outside recipient should enter a shared passwordProtected by a password
Existing workspace members need the filePrivate
Workspace members only need access for a limited periodPrivate + Expiry

These examples are useful starting points rather than fixed rules. The available combinations still depend on the account, workspace and file being shared.

You can check the broader set of controls under Security & Access.

Real use

Where Private access fits real projects

A design review can stay inside the client workspace

The designer uploads the draft of the banner to the client's workspace, where the reviewer is already able to access it.

For this reason, there is no need to make the draft public by generating a link. Therefore, keeping the draft Private allows the existing workspace membership to control who can view the draft.

If the reviewer exits the project at a later date, the reviewer's access can be updated based upon the workspace, rather than requiring someone to locate and update a separately generated shared password.

Internal documents do not need to be passed around as attachments

The usefulness of a project PDF lasts for many months. Every time a member wants to view the project PDF, you would need to send them a new copy. If you send a new copy each time, you will create many copies. It will then be difficult to determine what copy is being used by the team.

Having the document in the workspace will allow each authorized user to access it at any time. Private access allows each member to have direct access to the document via a private URL.

Contractor access can follow the duration of the project

A contractor joins the workspace and needs multiple project files during his/her active contract period. Since he/she has joined as a member of the workspace, he/she will have access to all the Private assets necessary for him/her to complete the tasks assigned to him/her.

Once his/her contract is complete, removing the contractor will alter what he/she can access in the workspace going forward. Because the contractor and the assets are managed independently, any files that were shared with other members of the team remain accessible to them even after the contractor has been removed.

An outdated draft can lose its link without affecting the rest of the project

Teams may require access to past drafts for reference purposes. However, no one should continue using the old share URL to view these files.

By revoking the old share URL, the file is no longer delivered via this method; however, the team members who were previously able to access the file using the old share URL will not be removed from the team's workspace. The project will proceed as usual, and the file can remain in the team's library as long as they need to refer back to it.

Private changes access, not the file itself

The original asset remains part of the Media2URL library, even if you make it private. However, the rule that Media2URL uses to determine how to handle the request to view the private link changes. After making the asset private, the person who receives the private link must have the proper workspace credentials and be logged into their account prior to being able to view the asset.

Access boundaries

What Private access does not do

  • Private access cannot prevent an authorized recipient from making copies of content that they have legally received. It simply restricts access via Media2URL.
  • Deleting a member will not automatically remove all the files that he/she was able to share with other users. Workspace membership and file storage are handled independently of each other.
  • Private access does not alter the normal procedure for uploading. All files must abide by the same account limitations and acceptable usage policy guidelines as if they were being uploaded with public access.
  • A recipient who cannot access the owner's workspace will not be able to rely on only the URL to download the file. Prior to utilizing private access as a means of sharing, verify that the recipient has the ability to access the owner's workspace.
Questions about Private links

Frequently asked questions

Yes, the recipient must have a Media2URL account and access to the workspace where the private asset resides. Simply receiving the URL will not allow the recipient to view the private asset.

The two types of links (Public and Unlisted) can be used to open the linked content by anyone who has a valid URL. The third type of link (Private) is more restrictive. In addition to being opened with a valid URL, the recipient must also be signed into the same workspace as the sender.

Yes, as long as both options exist within the specific file and user account. Private access defines which users can access files via the workspace. Expiration defines how long the shared access will remain valid.

The person's workspace access will be updated based upon the membership change that occurred. Your removal of a member from the workspace does not automatically delete files that were uploaded to the workspace prior to their removal.

Password Protection allows users access to files once they enter the correct password. Private Access allows users access to files if they are logged into their Media2URL accounts and have permission to access the Workspace where the file resides. Password Protection may be used by external recipients who will never become members of the Workspace. Private Access is best utilized for Workspace Members whose permissions should align with their Workspace status.

The forwarded link does not provide a way for the recipient to gain entry into the sender's workspace. Even if a user is from outside of the workspace that created the file, they will still need to have an appropriate level of authorization to view the Private file. Additionally, users who are authorized to view the file may still be able to create copies of the content in accordance with their authorizations.

No. Private controls how the user accesses the file, it does not create a new file or automatically delete the current file. The file link, file settings and the stored asset will all still be managed separately.

When an anonymous visitor to your site needs to download the image, the Private asset requires that the visitor have the required workspace access and is logged into the system. Therefore, a standard public website cannot rely on this type of hosted file in the same manner as a publicly available file.

Next steps

Explore related workspace and access tools

Media Library

For managing stored assets separately from link states.