Giving Clients (External Users) access to a Workspace


To grant access to External Users (such as a client) to items inside NetDocuments, you will first need to add the users to your NetDocuments Repository. 

If you are using ShareSpaces, you must be a Repository Administrator or a Member Administrator to add a new user.

NOTE: If a user has VESA access to the CollabSpaces, the user may add new external users to the cabinet without being a Repository Administrator or a Member Administrator.

To add a new user:

  1. On the Home page, select the Hi, <username> dropdown menu, and then select Admin to go to the Repository Administration page. 
  2. Go to the Users & Groups section. 
  3. Select Add User.


  1. Enter the new user's email address and select OK. 


If the person is a currently registered NetDocuments user, you will receive a message that the person already exists and it will ask you if you want to add them to your repository. If they have not been registered previously, you will be asked to create an account for them by entering some general information such as the full name of the person and assign the person a login Username.  We recommend that you make the username the full email address of the person. 

  1. In the dialog, you can provide some details:
    • Phone number
    • Organization
    • User type

NOTE:  Make sure you set them as External User. The person will then be sent a notification by e-mail with the Login Username and a link so they can enter their password and log in.

    • Repository admin type:
      • Full
      • Membership Only
      • Non-Admin
    • Other options: turn the toggle on/off for the Non-Interactive Service Account and Send welcome email options.


  1. Once the new user has been added as an External User they will then need to be added to a User & Group in the repository that is designated as an external group.

User & Groups simplify the administration of access controls on documents, folders, Sharespaces, and cabinets. Each user can belong to one or more user groups. A user must be a member of at least one group to be given access to a Cabinet. 

If the User Group has not already been created you will need to create a new group.

In the Groups tab, select the Create Group button.


Select the checkbox next to the group name to view the group’s membership or to delete the group.


Select the Edit button to change the group's name, modify membership, turn the toggle on/off for some group options.

Go to the Members tab, to add new users to a group.


Now, that the user or users have been added to the Repository and are assigned to a User Group, that group will then need to be added to the Cabinet. 

NOTE: In some cases, firms may choose to create a separate cabinet as an extranet to be used solely for external user access. 

  1. On the Navigation pane of NetDocuments Admin Console, select Cabinets.
  2. Select the cabinet.


  1. Scroll down to the Cabinet Security section.  You should see the User Group you just created when selecting the Display to All groups


  1. Give the User Group access to the cabinet. Find the group, then select the Add button to add them to the Cabinet Membership List.

External groups will automatically be given No Default Access to the Cabinet.  This means they are members of the cabinet but they do not have access to any folders or documents inside yet.  Once that is done, scroll down and select the Submit button. 

NOTE: If you are using workspaces, we highly recommend giving all External User groups No Default Access. If you do not use workspaces, skip to Step #9 and stop there. Steps #5-8 and #10-12 only apply to workspaces. 

Now that the users have access at the Cabinet level, they will need to be given access at the Profile Attribute level so that any new documents added to the Workspace will get the correct access. 

  1. To do this, you will first need to go to the Profile Attributes section on the Navigation pane of NetDocuments Admin Console.
  2. Select your Workspace Attribute to edit.

NOTE: We will use Matter for this tutorial but you may be using a different attribute. 


  1. Select the Modify Attribute Definition link on the left side of the screen and make sure that you have selected the Base Security on this Attribute checkbox and then click OK.


  1. Select the Matter that you need to restrict and double-click the row.  You will then need to add the access string to the Access field. 


The syntax for the Access column is as follows:

[<groupname>|<Access Level>*U:user email address |<Access Level>]    

The Access Level always needs to be in all upper-case.  

Here are some examples of using the access column:




Things to remember when using Profile-based security:

  • No Access Rights - When you give a user or group No Access rights for a document or a folder, using the Profile-based security, the No Access will trump any other rights they may have been given.
  • Absolute Rights - When using Profile-based security as described above, it is "additive" to the cabinet default or whatever the security is currently set to.  You can also use an absolute security model, which will change the current access of the items and replace it with the new absolute security.  For each row in your table where you want to use absolute security, precede it with an exclamation mark as follows:


The exclamation mark will affect the entire entry, not just the entry with the exclamation mark.

In this example, any documents added to this Matter will receive the access specified in the Matter Access column.

Now, that the users have access at the profile level, they will need to be given access to the existing Workspace (or folder) and documents that you want them to have access to.  It is best to start with the workspace first.

  1. To do this, open up the Workspace and select Workspace Options, and then choose Modify Access. This will show you the current Access List of the Workspace, select Modify Access here to add the new group to this list.  


You will need to select External Groups in the dropdown menu on the left.  Then you will need to click on the new group and click Select.  You can then choose what specific access rights you want them to have; V, VS, VE, VES, or VESA. 

View a list of the various access levels and their rights.

  1. The users will now have access to the main Workspace itself and we can move on to give them access to the documents within the Workspace. 

To do this, you will need to run a search in NetDocuments for all items in that particular Matter or if you are viewing the Workspace in Summary view, switch to List View and all the documents for that Workspace will appear.  When the search results are displayed, select the Search Result Options button and then select the Modify Access option.


  1. This option will take you to the Mass Access Change dialog that will allow you to modify the access of all documents (up to 10,000) in the search results.

Modify the access as needed (note the Change Mode option) and select the OK button. This will run in the background and send you an email when it has completed processing.  


  1. You may also need to give the External User access to any folders or Saved Searches on the workspace. Also, if you are using Workspace Filters in your Workspaces, you will need to open each Filter and modify the access of the Filters as well:


Any container (Folder, Filter, Saved Search) created on a Workspace will inherit the ACL of the Workspace, MINUS any External entities so if a new container is created and you need the External user/group to have access to it, you would need to manually change the ACL of that container. 

NOTE: If you are a cabinet administrator, you can search for filters by using the search criteria =11( ndflt ). This will allow you to change the access on a group of filters all at once. Otherwise, they will need to have their access modified individually. 


The External Users should now have access to all items currently in the Workspace and any items added to the Workspace going forward. 

NOTE: You may also want to hide your lookup table from External Users.  This can be done by going to Admin > Define Profile Attributes, selecting your attribute, and selecting Edit.  Then you can click Modify Attribute Definition at the top-left and check the box to hide the lookup table from External Users.

Logging In

If an external user is added to a cabinet when that user logs in.

  • If they do not have access to any folder or workspace, they will be taken to the cabinet's Home page.
  • If they have access to only one workspace, they will go directly to that workspace.
  • If they have access to more than one workspace or more than one cabinet, they will go to their Home Page, just as an Internal User would. Those workspaces will automatically be Favorited for the user and will be added to their Home Page.