Skip to content

5. Managing team folders (for managers)

This chapter is for people who manage a team folder – the list then shows “managed by you”, and there is a “Manage” button.

People and groups

Under “Manage” you see all members with their role.

  • Add: Under “Add”, search for a name, email, or group, then click “Add” (member) or “Add as manager”. Afterwards, check the people under “Pending access” and click “Grant access” – preferably only after you have verified their identity (see below).
  • Change role: “Make manager” or “Make member”.
  • Remove: “Remove” next to the person. This applies to future opening. Anyone who has already opened the team folder may have kept files they downloaded and a copy of the key. So for confidential content, renew the key afterwards (see below).

Groups come from your organization account (for example Microsoft 365 groups). New group members get access as soon as you have granted it.

Verifying identity

When granting access, Krywerk encrypts the team folder's key to the key that the key server provides for that person. A manipulated key server could slip in someone else's key. With “Verify identity …” you make sure the key really belongs to the person.

Under “Waiting for access” and in the member list, each person is marked:

  • “verified ✓” – you have verified the identity (or someone whose identity you verified has verified it). The person is preselected for granting access.
  • “not verified ⚠” – not verified yet, or the person has received new keys (for example after an account reset). The person is not preselected.

How to verify an identity:

  1. Call the person or talk to them in person – not by email or chat.
  2. Ask them to open ⚙ Settings › Organization account › “Show fingerprint” in Krywerk and read their fingerprint out to you.
  3. Click “Verify identity …” next to the person and type in the first characters (the dialog says how many; at least 8). Spaces and upper or lower case don't matter.
  4. The very first time you verify on a computer, Krywerk also asks for your unlock code. After that, it works without it on this computer.
  5. “Confirm identity”. If the characters don't match, Krywerk confirms nothing – have the fingerprint read out to you once more. If they still don't match, do not grant access and inform your IT administration.

You can still check a person who is not verified. Krywerk then shows a warning and asks again before granting access. This only makes sense if you trust the key server.

For emergency access, too, Krywerk indicates when the identity of council members or of the requesting person has not been verified. Krywerk doesn't block anything there. Verify the identity and, if in doubt, set up emergency access again.

Recovery key

Every team folder has a recovery key (28 groups of four letters and digits). With it, the team folder can be opened even without the key server – for example if the server fails or is shut down. Whoever has it can read all the team folder's files.

  • Krywerk shows it once when the folder is created. To see it again later: “Manage” › “Show recovery key …”.
  • To keep it safe: “Print …” it and deposit it sealed with the school management, or “Save as file …” in a secure password manager. Not in the team folder itself, and not unencrypted in OneDrive.
  • Opening without a server: In the team folder's row, choose “Open without server …” and enter the key. Krywerk does not remember the key.

Emergency access (four-eyes principle)

If all managers become unavailable, nobody can add people or grant access anymore. That is what emergency access is for: an emergency council (for example the principal and the deputy) can jointly give a person the manager role – but only if enough people approve.

Setting it up (manager): “Manage” › Emergency access › “Set up …”

  1. Choose people for the council (only people with a set-up organization account, no groups).
  2. Specify how many must approve – at least 2. A single person never gets access alone.
  3. “Set up emergency access”.

In an emergency (council member):

  1. Open ⚙ Settings › Organization account › Emergency access.
  2. On the team folder, choose “Request emergency access …” and give a reason. Your own vote does not count.
  3. The other council members see the notice “An emergency request is waiting for you” on their overview with “Review”, and approve with “Approve …”. Only approve once you have checked the request – for example in person or by phone.
  4. Once there are enough approvals, the requesting person clicks “Complete” and then manages the team folder. An open request can be withdrawn with “Cancel …”.

Renewing the key (after someone leaves)

When someone leaves the group, the team folder should get a new key. Anyone who was excluded then cannot read the new content, even with an old copy of the key.

Beforehand: Ask all members to close the team folder. Changes made during the process are lost. On your own computer, Krywerk closes the folder itself.

  1. “Manage” › “Renew key …”.
  2. Under “Don't carry over”, check the people who have left.
  3. Optionally “Keep old encrypted data” – it then stays next to the folder, readable with the old key.
  4. Click “Renew key”. Krywerk creates a new team folder with a new key, carries over the members, re-encrypts the content, and swaps it in the same folder. The OneDrive share stays in place. The old team folder is archived.
  5. Krywerk shows a new recovery key. The old one only opens the archived state.

Afterwards, OneDrive syncs the entire content again. Older copies (recycle bin, OneDrive version history, copies held by people who have left) remain readable with the old key. If the process is interrupted, “Resume key renewal …” continues it later.

Archiving

“Manage” › “Archive …” locks the team folder: nobody can open it anymore, but the files are kept. “Reactivate” undoes this.