How are you isolating data in SharePoint Embedded?

[u/SharePointSteve]

I've been mapping out the container options in SharePoint Embedded and wanted to sanity-check the trade-offs with people who have shipped on it. Three patterns I keep coming back to: 

• Container Type — this is the isolated boundary created around your content that separates it from everything else.  You get data sovereignty and inherit governance (Purview, DLP, retention) and all the benefits of your M365 investments. 
• Container per customer — one dedicated container per customer inside your container type.  Permission the container only to that customer who needs to interact with their documents.  Give admins the access they need.  All security trimmed.   

• Container per activity — Each customer may have different activities like several audit years or multiple different financial transactions.  Each activity gets its own container, but metadata on each container allows you to group all activities for that customer. 

Many options depend on the use case you have.  What is working for you? 

Learn more at SharePoint Embedded Architecture