Indiana University Reduces Data Exposure and Secures Collaboration Across a Modern University Environment

As one of the nation's largest research universities, Indiana University supports a diverse community of students, faculty, researchers, clinicians, and administrators. With nearly four petabytes of data spread across Microsoft 365, OneDrive, SharePoint, Teams, file servers, and Active Directory, protecting sensitive information while preserving the open, collaborative nature of higher education had become increasingly complex — data is continuously generated but seldom removed, resulting in long-term sprawl that expands the attack surface across identities, data, and connected systems.

By design, higher education is an open and collaborative information and information technology environment. Any solution we implement has to balance the protections being provided with risk and user impact.

CHALLENGE

Managing Exposure Across a Large, Open Environment

With a lean security team supporting roughly 35,000 employees, 120,000 students, and nearly 300,000 devices, Indiana University needed a scalable way to identify sensitive data, reduce exposure, and respond to threats enterprise-wide. Having used Varonis for years within individual departments, the university began exploring enterprise-wide deployment with a proof of concept targeting publicly accessible sites and collaboration links.

The results made the scale of the problem clear: a sprawling volume of collaboration links existed across Microsoft 365 and Teams, some connected to files containing sensitive or regulated information.

We found hundreds of thousands of collaboration links. Luckily, not all of them were to sensitive data, but the sheer number was massive.

SOLUTION

Strengthening Classification Without Disruption

To minimize disruption during the enterprise-wide rollout, Indiana University initially reviewed remediation actions manually — validating findings, removing risky sharing links, and communicating directly with affected users before automating the process. That approach built confidence across the university while demonstrating the accuracy of Varonis' classifications.

The proof of concept established that Varonis typically has a very low number of false positives. Most responses were people saying they didn't realize they had created that link or didn't realize sensitive data was in that file.

As confidence grew, the university expanded automation across SharePoint Online, Teams, and OneDrive, using Varonis to continuously identify and remediate risky exposures, while integrating Microsoft Purview labels across nearly three million sensitive files.

Operationalizing Continuous Exposure Reduction

Once automation was in place, Varonis helped Indiana University move from periodic cleanup to continuous exposure reduction — automatically identifying risky access, prioritizing sensitive data exposures, and remediating issues before they could linger. Within weeks, this approach drove a 93% reduction in overexposed sensitive files and a 95% reduction in links exposing sensitive data.

Accelerating Threat Detection and Investigations

Beyond classification and remediation, Varonis gave the university deeper visibility into user behavior, access patterns, and activity around sensitive data. Correlating identity, permissions, data sensitivity, and activity helped the team detect signs of compromised accounts, insider risk, and potential data exfiltration faster — with Varonis' threat detection and Managed Data Detection and Response (MDDR) services turning that context into high-fidelity alerts with minimal false positives.

RESULTS

A Broader Program for Governing Data at Scale

With Varonis, Indiana University has significantly reduced sensitive data exposure, operationalized automated remediation, and expanded visibility across its enterprise environment. What began as an effort to understand data exposure and collaboration risk has evolved into a broader program for governing data, strengthening security operations, and supporting safer collaboration at scale.

Looking Ahead

As the deployment matured, Indiana University began using Varonis insights to tackle data sprawl directly — analyzing usage and activity patterns across SharePoint, OneDrive, and file servers to identify large volumes of stale data that hadn't been accessed in years. Those insights are now informing data lifecycle initiatives designed to reduce storage costs and further improve governance.