Microsoft SharePoint

What Microsoft SharePoint is

Microsoft SharePoint is a web based collaboration and content management platform from Microsoft, available both as the cloud service SharePoint Online inside Microsoft 365 and as the self hosted SharePoint Server. Organisations use it to build intranets, document libraries, team sites and public facing websites. When SharePoint pages are served to end users, the platform relies on authentication and session cookies to manage sign in state, security and the rendering of personalised content. Because SharePoint is frequently the backbone of corporate portals that process employee and customer data, its cookie behaviour and data residency are squarely in scope for the GDPR.

Cookies and storage set by SharePoint

SharePoint Online authenticates users through Azure Active Directory and sets several first party cookies on the sharepoint.com domain. The main ones are rtFa, used for cross site federated authentication across Microsoft 365, and FedAuth, the federated authentication session cookie. The platform also writes operational cookies such as WSS_FullScreenMode to remember interface state. Microsoft 365 properties may additionally drop MUID and the analytics cookie MSFPC tied to Microsoft telemetry. The authentication cookies are strictly necessary to keep the user signed in, while telemetry cookies are not.

GDPR and ePrivacy implications

Under article 5(3) of the ePrivacy Directive, storing cookies that are strictly necessary to deliver a service explicitly requested by the user is exempt from prior consent. The SharePoint sign in and session cookies fall inside that exemption because no authenticated session can exist without them. The GDPR still applies to the personal data processed: account identifiers, IP addresses, document metadata and audit logs. The controller, normally the organisation running the tenant, must define a lawful basis, usually contract for employees and legitimate interest or contract for external collaborators, and document Microsoft as a processor.

Consent requirements

For a private intranet behind a login, consent for the authentication cookies is not required because they are strictly necessary and the user actively requests the authenticated session. If SharePoint is used to power a public website, or if Microsoft 365 analytics, Clarity or third party embeds are added, then any non essential cookie used for analytics or personalisation requires prior informed consent collected through a consent banner before the script runs. The strictly necessary set can always load first.

International data transfers

Microsoft Corporation is established in the United States and is certified under the EU US Data Privacy Framework since 2023. SharePoint Online data is hosted in the Microsoft 365 data centre region chosen for the tenant, and customers in the European Union can rely on the Microsoft EU Data Boundary to keep core customer data and processing within Europe. Some support, telemetry and troubleshooting operations may still involve Microsoft staff outside the EU under the Standard Contractual Clauses included in the Microsoft Products and Services Data Protection Addendum.

Practical compliance steps

Record Microsoft as a processor in your article 30 register and sign the Microsoft Data Protection Addendum. Configure the tenant region and enable the EU Data Boundary if European residency is required. List the SharePoint authentication cookies in your cookie policy as strictly necessary and explain their purpose and duration. If you expose SharePoint content publicly, place any analytics or embedded media behind a consent banner. Review audit log retention, restrict external sharing, and apply Microsoft Purview retention and sensitivity labels to govern personal data stored in document libraries.