diff --git a/frontend/src/assets/main.scss b/frontend/src/assets/main.scss
index af54a33f..5cda649f 100644
--- a/frontend/src/assets/main.scss
+++ b/frontend/src/assets/main.scss
@@ -254,6 +254,12 @@ div:focus-visible {
   font-size: .8rem;
   padding: 0.25rem 0.75rem;
   font-weight: 400;
+  line-height: 1;
+
+  .p-tag-value {
+    margin-top: -2px;
+  }
+
 }
 
 .p-tag-danger {
@@ -271,6 +277,21 @@ div:focus-visible {
   }
 }
 
+.p-tag-info {
+  background-color: rgb(224, 242, 254);
+  outline-style: solid;
+  outline-color: $bcbox-primary;
+  outline-width: thin;
+
+  .p-tag-value {
+    color: $bcbox-primary;
+  }
+
+  .p-tag-icon {
+    color: $bcbox-primary
+  }
+}
+
 /* datatable */
 .p-datatable,
 .p-treetable {
diff --git a/frontend/src/components/bucket/BucketIdpToggle.vue b/frontend/src/components/bucket/BucketIdpToggle.vue
new file mode 100644
index 00000000..16479c87
--- /dev/null
+++ b/frontend/src/components/bucket/BucketIdpToggle.vue
@@ -0,0 +1,154 @@
+<script setup lang="ts">
+import { computed, onMounted, ref, watch } from 'vue';
+
+import { InputSwitch, useConfirm, useToast } from '@/lib/primevue';
+import { useBucketStore, usePermissionStore } from '@/store';
+import { bucketService } from '@/services';
+import { Permissions } from '@/utils/constants';
+
+import { getParentKey } from '@/utils/utils';
+import type { Ref } from 'vue';
+
+// Props
+type Props = {
+  bucketId: string;
+  bucketName: string;
+  bucketPublic: boolean;
+  userId: string;
+};
+const props = withDefaults(defineProps<Props>(), {});
+
+// Store
+const bucketStore = useBucketStore();
+const permissionStore = usePermissionStore();
+
+// State
+const isInternal: Ref<boolean> = ref(false);
+const isParentBucketInternal = ref(false);
+
+const isInternalState = computed(() => {
+  return permissionStore.getBucketInternal(props.bucketId) || props.bucketPublic || isParentBucketInternal.value;
+});
+
+const isToggleEnabled = computed(() => {
+  return (
+    !isParentBucketInternal.value &&
+    !props.bucketPublic &&
+    usePermissionStore().isUserElevatedRights() &&
+    permissionStore.isBucketActionAllowed(props.bucketId, props.userId, Permissions.MANAGE)
+  );
+});
+
+// Actions
+const toast = useToast();
+const confirm = useConfirm();
+
+const toggleIdp = async (value: boolean) => {
+  if (value) {
+    confirm.require({
+      message: "Setting this file to 'Internal only' will allow all IDIR users " + 'to view and download it.',
+      header: 'Set file to Internal only?',
+      acceptLabel: 'Set to Internal only',
+      rejectLabel: 'Cancel',
+      accept: () => {
+        permissionStore
+          .addBucketIdpPermission(props.bucketId, 'idir', 'READ')
+          .then(() => {
+            isInternal.value = true;
+            toast.success('File set to Internal only', `"${props.bucketName}" is now Internal only`);
+          })
+          .catch((e) => toast.error('Setting file to Internal only failed', e.response?.data.detail, { life: 0 }));
+      },
+      reject: () => (isInternal.value = false),
+      onHide: () => (isInternal.value = false)
+    });
+  } else
+    confirm.require({
+      message:
+        "Setting this file to private will remove 'Internal only' access. " +
+        'Only users with permissions will be able to view or download the file.',
+      header: 'Set file to private?',
+      acceptLabel: 'Set to private',
+      rejectLabel: 'Cancel',
+      accept: () => {
+        permissionStore
+          .deleteBucketIdpPermission(props.bucketId, 'idir', 'READ')
+          .then(() => {
+            isInternal.value = false;
+            toast.success('File set to private', `"${props.bucketName}" is no longer 'Internal only'`);
+          })
+          .catch((e) => toast.error('Setting file to private failed', e.response?.data.detail, { life: 0 }));
+      },
+      reject: () => (isInternal.value = true),
+      onHide: () => (isInternal.value = true)
+    });
+};
+
+onMounted(async () => {
+  // refresh current bucket IDP permissions
+  await permissionStore.fetchBucketIdpPermissions({
+    bucketId: props.bucketId,
+    permCode: 'READ',
+    idp: 'idir'
+  });
+
+  // get immediate parent bucket IDP permissions
+  // TODO: get perms for every parent in path (eg: x/y/z/currentBucket)
+  // let isParentBucketInternal = false;
+  const bucket = bucketStore.getBucket(props.bucketId);
+  if (bucket) {
+    // if current bucket is not at root
+    if (bucket.key !== '/') {
+      // search for parent bucket by endpoint and bucket and segment of key
+      const responseArray = (
+        await bucketService.searchBuckets({
+          key: getParentKey(bucket.key),
+          endpoint: bucket.endpoint,
+          bucket: bucket.bucket
+        })
+      ).data;
+      const parent = responseArray.reduce((a: any, b: any) => (a.key.length <= b.key.length ? a : b));
+      // fetch bucketIdpPermissions for parent
+      await permissionStore.fetchBucketIdpPermissions({
+        bucketId: parent.bucketId,
+        permCode: 'READ',
+        idp: 'idir'
+      });
+      isParentBucketInternal.value = permissionStore.getBucketInternal(parent.bucketId);
+    }
+  }
+  isInternal.value = isInternalState.value;
+});
+
+watch(props, () => {
+  if (props.bucketPublic === true) isInternal.value = true;
+  else {
+    const perms = permissionStore.getBucketIdpPermissions.filter(
+      (p: any) => p.permCode === Permissions.READ && p.bucketId === props.bucketId && p.idp === 'idir'
+    );
+    if (perms.length > 0) isInternal.value = true;
+    else {
+      isInternal.value = false;
+    }
+  }
+});
+</script>
+
+<template>
+  <span
+    v-tooltip="
+      isToggleEnabled
+        ? ''
+        : props.bucketPublic
+          ? 'Enabled by Public Sharing'
+          : 'Change the folder\'s \'Internal only\' setting to update this file'
+    "
+  >
+    <InputSwitch
+      :model-value="isInternal"
+      aria-label="Toggle to make file Internal only"
+      :disabled="!isToggleEnabled"
+      @update:model-value="toggleIdp($event)"
+    />
+  </span>
+</template>
diff --git a/frontend/src/components/bucket/BucketList.vue b/frontend/src/components/bucket/BucketList.vue
index efe7ccca..16c8d986 100644
--- a/frontend/src/components/bucket/BucketList.vue
+++ b/frontend/src/components/bucket/BucketList.vue
@@ -43,7 +43,19 @@ const closeBucketConfig = () => {
 };
 
 onMounted(async () => {
-  await bucketStore.fetchBuckets({ userId: getUserId.value, objectPerms: true });
+  const buckets = await bucketStore.fetchBuckets({
+    userId: getUserId.value,
+    objectPerms: true
+  });
+  // get IDP permissions for labelling in table
+  if (buckets && buckets.length > 0 && usePermissionStore().isUserElevatedRights()) {
+    await usePermissionStore().fetchBucketIdpPermissions({
+      // limit to 1000 folders
+      bucketId: buckets.slice(0, 1000).map((b) => b.bucketId),
+      idp: 'idir',
+      objectPerms: true
+    });
+  }
 });
 </script>
 
@@ -103,7 +115,7 @@ onMounted(async () => {
           {{ bucketConfigTitle }}
         </h3>
 
-        <!-- <Message severity="warn">
+        <Message severity="warn">
           If you intend to share files in your bucket with BCeID or BC Services Card users, please notify
           <a href="mailto:IDIM.Consulting@gov.bc.ca">IDIM.Consulting@gov.bc.ca</a>
           that you plan to use BCBox.
@@ -119,7 +131,7 @@ onMounted(async () => {
           </a>
           (Natural Resource ministries) or your ministry's service desk if you need help with &quot;bucket&quot; storage
           location sources.
-        </Message> -->
+        </Message>
 
         <BucketConfigForm
           :bucket="bucketToUpdate"
diff --git a/frontend/src/components/bucket/BucketPermission.vue b/frontend/src/components/bucket/BucketPermission.vue
index 9946ff72..c71c7f2a 100644
--- a/frontend/src/components/bucket/BucketPermission.vue
+++ b/frontend/src/components/bucket/BucketPermission.vue
@@ -3,7 +3,7 @@ import { storeToRefs } from 'pinia';
 import { computed, onBeforeMount, ref } from 'vue';
 import { FontAwesomeIcon } from '@fortawesome/vue-fontawesome';
 
-import BucketPublicToggle from '@/components/bucket/BucketPublicToggle.vue';
+import { BucketPublicToggle, BucketIdpToggle } from '@/components/bucket';
 import BucketPermissionAddUser from '@/components/bucket/BucketPermissionAddUser.vue';
 import { BulkPermission } from '@/components/common';
 import { useAlert } from '@/composables/useAlert';
@@ -82,16 +82,15 @@ onBeforeMount(async () => {
 <template>
   <TabView>
     <TabPanel header="Manage permissions">
+      <h3>Sharing Access</h3>
       <!-- public toggle -->
       <div class="flex pb-3">
         <div class="flex-grow-1">
           <div class="pb-1">
-            <h3>Set to public</h3>
+            <h4>Set to public</h4>
             <p>
-              Making a folder
-              <strong>public</strong>
-              means that all files within it, including those in any subfolders, can be accessed by anyone without
-              requiring authentication.
+              Enabling this shares all files and subfolders. Anyone with the link can view the content without signing
+              in.
             </p>
           </div>
         </div>
@@ -104,6 +103,21 @@ onBeforeMount(async () => {
           :user-id="getUserId"
         />
       </div>
+
+      <div class="flex flex-row pb-3">
+        <div class="flex-grow-1">
+          <h4 class="pb-1">Internal only</h4>
+          <p>Allow all IDIR users to view this folder and its content</p>
+        </div>
+        <BucketIdpToggle
+          v-if="bucket && getUserId"
+          :bucket-id="bucket.bucketId"
+          :bucket-name="bucket.bucketName"
+          :bucket-public="bucket.public"
+          :user-id="getUserId"
+        />
+      </div>
+
       <h3>User Permissions</h3>
       <!-- user search -->
       <div v-if="!showSearchUsers">
@@ -156,7 +170,7 @@ onBeforeMount(async () => {
           aria-labelledby="upload_checkbox"
         />
         <Column
-          field="idpName"
+          field="idp"
           header="Provider"
         />
         <Column
diff --git a/frontend/src/components/bucket/BucketPermissionAddUser.vue b/frontend/src/components/bucket/BucketPermissionAddUser.vue
index c1a84dea..1eaed32d 100644
--- a/frontend/src/components/bucket/BucketPermissionAddUser.vue
+++ b/frontend/src/components/bucket/BucketPermissionAddUser.vue
@@ -13,12 +13,12 @@ const permissionStore = usePermissionStore();
 // Actions
 const onAdd = (selectedUser: User) => {
   const configuredIdp = getConfig.value.idpList.find((idp: IdentityProvider) => idp.idp === selectedUser.idp);
-  const idpName = configuredIdp?.name || 'BCSC';
+  const idp = configuredIdp?.name || 'BCSC';
   const idpElevated = configuredIdp?.elevatedRights || false;
 
   permissionStore.addBucketUser({
     userId: selectedUser.userId,
-    idpName: idpName,
+    idp: idp,
     elevatedRights: idpElevated,
     fullName: selectedUser.fullName,
     create: false,
diff --git a/frontend/src/components/bucket/BucketTable.vue b/frontend/src/components/bucket/BucketTable.vue
index b1ef82ef..3be04723 100644
--- a/frontend/src/components/bucket/BucketTable.vue
+++ b/frontend/src/components/bucket/BucketTable.vue
@@ -181,7 +181,11 @@ function createDummyNodes(neighbour: BucketTreeNode, node: BucketTreeNode) {
   return current;
 }
 
-watch(getBuckets, () => {
+/**
+ * watch for changes to bucket and permissions in store
+ */
+// eslint-disable-next-line no-empty-pattern
+watch([getBuckets, permissionStore.getBucketIdpPermissions], ([]) => {
   // Make sure everything is clear for a rebuild...
   endpointMap.clear();
   bucketTreeNodeMap.clear();
@@ -319,72 +323,86 @@ watch(getBuckets, () => {
       </template>
     </Column>
     <Column
-      header="Actions"
-      header-class="text-right"
-      body-class="action-buttons"
-      header-style="width: 320px"
+      field="publicSharing"
+      header="Sharing"
+      style="width: 150px"
     >
+      >
       <template #body="{ node }">
         <span v-if="!node.data.dummy">
           <Tag
             v-if="getBucketPublicStatus(node)"
-            v-tooltip="
-              'This folder and its contents are set to public. Change the settings in &quot;Folder permissions.&quot;'
-            "
             value="Public"
             severity="danger"
             rounded
-            icon="pi pi-info-circle"
-            class="public-folder"
-          />
-          <BucketChildConfig
-            v-if="permissionStore.isBucketActionAllowed(node.data.bucketId, getUserId, Permissions.CREATE)"
-            :parent-bucket="node.data"
           />
-          <Button
-            v-if="permissionStore.isBucketActionAllowed(node.data.bucketId, getUserId, Permissions.MANAGE)"
-            id="folder_permissions"
-            v-tooltip.bottom="'Folder permissions'"
-            class="p-button-lg p-button-text"
-            aria-label="Folder permissions"
-            @click="showPermissions(node.data.bucketId, node.data.bucketName)"
-          >
-            <span class="material-icons-outlined">supervisor_account</span>
-          </Button>
-          <ShareButton
-            :bucket-id="node.data.bucketId"
-            label-text="Folder"
+          <Tag
+            v-else-if="
+              permissionStore.getBucketInternal(node.data.bucketId) && usePermissionStore().isUserElevatedRights()
+            "
+            value="Internal (IDIR)"
+            severity="info"
+            rounded
+            class="mb-1 min-w-100"
           />
-          <Button
-            v-if="permissionStore.isBucketActionAllowed(node.data.bucketId, getUserId, Permissions.MANAGE)"
-            v-tooltip.bottom="'Configure folder'"
-            class="p-button-lg p-button-text"
-            aria-label="Configure folder"
-            @click="showBucketConfig({ ...node.data, isRoot: node.isRoot })"
-          >
-            <span class="material-icons-outlined">settings</span>
-          </Button>
-          <Button
-            v-if="permissionStore.isBucketActionAllowed(node.data.bucketId, getUserId, Permissions.READ)"
-            v-tooltip.bottom="'Folder details'"
-            class="p-button-lg p-button-rounded p-button-text"
-            aria-label="Folder details"
-            @click="showSidebarInfo(node.data.bucketId)"
-          >
-            <span class="material-icons-outlined">info</span>
-          </Button>
-          <Button
-            v-if="permissionStore.isBucketActionAllowed(node.data.bucketId, getUserId, Permissions.DELETE)"
-            v-tooltip.bottom="'Delete folder'"
-            class="p-button-lg p-button-text p-button-danger"
-            aria-label="Delete folder"
-            @click="confirmDeleteBucket(node.data.bucketId)"
-          >
-            <span class="material-icons-outlined">delete</span>
-          </Button>
         </span>
       </template>
     </Column>
+
+    <Column
+      header="Actions"
+      header-class="text-right"
+      body-class="action-buttons"
+      header-style="width: 20px"
+    >
+      <template #body="{ node }">
+        <BucketChildConfig
+          v-if="permissionStore.isBucketActionAllowed(node.data.bucketId, getUserId, Permissions.CREATE)"
+          :parent-bucket="node.data"
+        />
+        <Button
+          v-if="permissionStore.isBucketActionAllowed(node.data.bucketId, getUserId, Permissions.MANAGE)"
+          id="folder_permissions"
+          v-tooltip.bottom="'Folder permissions'"
+          class="p-button-lg p-button-text"
+          aria-label="Folder permissions"
+          @click="showPermissions(node.data.bucketId, node.data.bucketName)"
+        >
+          <span class="material-icons-outlined">supervisor_account</span>
+        </Button>
+        <ShareButton
+          :bucket-id="node.data.bucketId"
+          label-text="Folder"
+        />
+        <Button
+          v-if="permissionStore.isBucketActionAllowed(node.data.bucketId, getUserId, Permissions.MANAGE)"
+          v-tooltip.bottom="'Configure folder'"
+          class="p-button-lg p-button-text"
+          aria-label="Configure folder"
+          @click="showBucketConfig({ ...node.data, isRoot: node.isRoot })"
+        >
+          <span class="material-icons-outlined">settings</span>
+        </Button>
+        <Button
+          v-if="permissionStore.isBucketActionAllowed(node.data.bucketId, getUserId, Permissions.READ)"
+          v-tooltip.bottom="'Folder details'"
+          class="p-button-lg p-button-rounded p-button-text"
+          aria-label="Folder details"
+          @click="showSidebarInfo(node.data.bucketId)"
+        >
+          <span class="material-icons-outlined">info</span>
+        </Button>
+        <Button
+          v-if="permissionStore.isBucketActionAllowed(node.data.bucketId, getUserId, Permissions.DELETE)"
+          v-tooltip.bottom="'Delete folder'"
+          class="p-button-lg p-button-text p-button-danger"
+          aria-label="Delete folder"
+          @click="confirmDeleteBucket(node.data.bucketId)"
+        >
+          <span class="material-icons-outlined">delete</span>
+        </Button>
+      </template>
+    </Column>
   </TreeTable>
 
   <!-- eslint-disable vue/no-v-model-argument -->
diff --git a/frontend/src/components/bucket/index.ts b/frontend/src/components/bucket/index.ts
index 04257c05..e4ac95d6 100644
--- a/frontend/src/components/bucket/index.ts
+++ b/frontend/src/components/bucket/index.ts
@@ -3,6 +3,8 @@ export { default as BucketConfigForm } from './BucketConfigForm.vue';
 export { default as BucketList } from './BucketList.vue';
 export { default as BucketPermission } from './BucketPermission.vue';
 export { default as BucketPermissionAddUser } from './BucketPermissionAddUser.vue';
+export { default as BucketPublicToggle } from './BucketPublicToggle.vue';
+export { default as BucketIdpToggle } from './BucketIdpToggle.vue';
 export { default as BucketSidebar } from './BucketSidebar.vue';
 export { default as BucketTable } from './BucketTable.vue';
 export { default as BucketTableBucketName } from './BucketTableBucketName.vue';
diff --git a/frontend/src/components/common/ShareButton.vue b/frontend/src/components/common/ShareButton.vue
index 52f4d761..c407feb7 100644
--- a/frontend/src/components/common/ShareButton.vue
+++ b/frontend/src/components/common/ShareButton.vue
@@ -98,14 +98,9 @@ const showDialog = (x: boolean) => {
       <span class="ml-3 text-sm flex-grow-1">
         <Tag
           v-if="resource?.public"
-          v-tooltip="
-            `This ${resourceType === 'object' ? 'file is' : 'folder and its contents are'} set to public. 
-              Change the settings in &quot;${resourceType === 'object' ? 'File' : 'Folder'} Permissions.&quot;`
-          "
           value="Public"
           severity="danger"
           rounded
-          icon="pi pi-info-circle"
         />
       </span>
     </template>
diff --git a/frontend/src/components/layout/Navbar.vue b/frontend/src/components/layout/Navbar.vue
index b4e220be..46af5e5c 100644
--- a/frontend/src/components/layout/Navbar.vue
+++ b/frontend/src/components/layout/Navbar.vue
@@ -39,7 +39,7 @@ const { getIsAuthenticated, getProfile } = storeToRefs(useAuthStore());
               :to="{ name: RouteNames.LIST_OBJECTS_DELETED }"
               aria-label="Recycle Bin"
             >
-            Recycle Bin
+              Recycle Bin
             </router-link>
           </li>
           <li class="mr-2">
diff --git a/frontend/src/components/object/ObjectFileDetails.vue b/frontend/src/components/object/ObjectFileDetails.vue
index 50aa728f..da64eb20 100644
--- a/frontend/src/components/object/ObjectFileDetails.vue
+++ b/frontend/src/components/object/ObjectFileDetails.vue
@@ -50,7 +50,7 @@ const permissionStore = usePermissionStore();
 const tagStore = useTagStore();
 const versionStore = useVersionStore();
 
-const { getUserId } = storeToRefs(useAuthStore());
+const { getProfile, getUserId } = storeToRefs(useAuthStore());
 const { getObject } = storeToRefs(objectStore);
 const {
   getIsDeleted,
@@ -65,6 +65,8 @@ const object: Ref<COMSObject | undefined> = ref(undefined);
 const bucketId: Ref<string> = ref('');
 const permissionsVisible: Ref<boolean> = ref(false);
 
+const isInternal = computed(() => permissionStore.getInternal(object.value));
+
 // version stuff
 const bucketVersioningEnabled = computed(() => getIsVersioningEnabled.value(props.objectId));
 const currentVersionId: Ref<string | undefined> = ref(props.versionId);
@@ -118,21 +120,27 @@ async function onVersionCreated() {
 
 onMounted(async () => {
   const head = await objectStore.headObject(props.objectId);
-
-  // TODO: sync object?
-  await objectStore.fetchObjects({ objectId: props.objectId, userId: getUserId.value, bucketPerms: true });
+  // fetch object and object permissions
+  await objectStore.fetchObjects({
+    objectId: props.objectId,
+    userId: getUserId.value,
+    idp: (getProfile.value as any)?.identity_provider,
+    bucketPerms: true
+  });
   object.value = getObject.value(props.objectId);
   bucketId.value = object.value ? object.value.bucketId : '';
-
-  await permissionStore.fetchBucketPermissions({
-    userId: getUserId.value,
+  // fetch bucket and bucket permissions
+  await bucketStore.fetchBuckets({
     bucketId: bucketId.value,
+    userId: getUserId.value,
+    idp: (getProfile.value as any)?.identity_provider,
     objectPerms: true
   });
   if (
     head?.status !== 204 &&
     !isDeleted.value &&
     (!object.value ||
+      // check for permissions in store
       !permissionStore.isObjectActionAllowed(object.value.id, getUserId.value, Permissions.READ, object.value.bucketId))
   ) {
     router.replace({ name: RouteNames.FORBIDDEN });
@@ -158,11 +166,15 @@ onMounted(async () => {
           <span class="ml-3 text-sm flex-grow-1">
             <Tag
               v-if="object?.public"
-              v-tooltip="`This file is set as public`"
               value="Public"
               severity="danger"
               rounded
-              icon="pi pi-info-circle"
+            />
+            <Tag
+              v-else-if="isInternal"
+              value="Internal (IDIR)"
+              severity="info"
+              rounded
             />
           </span>
         </div>
diff --git a/frontend/src/components/object/ObjectIdpToggle.vue b/frontend/src/components/object/ObjectIdpToggle.vue
new file mode 100644
index 00000000..c56ea40e
--- /dev/null
+++ b/frontend/src/components/object/ObjectIdpToggle.vue
@@ -0,0 +1,125 @@
+<script setup lang="ts">
+import { computed, onMounted } from 'vue';
+
+import { InputSwitch, useConfirm, useToast } from '@/lib/primevue';
+import { useBucketStore, usePermissionStore } from '@/store';
+import { Permissions } from '@/utils/constants';
+
+import type { Ref } from 'vue';
+
+// Props
+type Props = {
+  bucketId: string;
+  objectId: string;
+  objectName: string;
+  objectPublic: boolean;
+  userId: string;
+};
+
+const props = withDefaults(defineProps<Props>(), {});
+
+// ---- State:
+const permissionStore = usePermissionStore();
+const bucketStore = useBucketStore();
+
+// has object IDP permission
+const isObjectInternal = computed(() => permissionStore.getObjectInternal(props.objectId));
+// has bucket IDP permission
+const isBucketInternal = computed(() => permissionStore.getBucketInternal(props.bucketId));
+// is public
+const isPublic: Ref<boolean> = computed(() => {
+  const bucketIsPublic = bucketStore.getBucket(props.bucketId)?.public ?? false;
+  return bucketIsPublic || props.objectPublic;
+});
+
+// value for toggle
+const switchVal: Ref<boolean> = computed(() => {
+  return isObjectInternal.value || isBucketInternal.value || isPublic.value;
+});
+
+const isToggleEnabled = computed(() => {
+  return (
+    !isBucketInternal.value &&
+    !isPublic.value &&
+    usePermissionStore().isUserElevatedRights() &&
+    permissionStore.isObjectActionAllowed(props.objectId, props.userId, Permissions.MANAGE, props.bucketId as string)
+  );
+});
+
+// Actions
+const toast = useToast();
+const confirm = useConfirm();
+
+const toggleIdp = async (value: boolean) => {
+  if (value) {
+    confirm.require({
+      message: "Setting this file to 'Internal only' will allow all IDIR users " + 'to view and download it.',
+      header: 'Set file to Internal only?',
+      acceptLabel: 'Set to Internal only',
+      rejectLabel: 'Cancel',
+      accept: () => {
+        permissionStore
+          .addObjectIdpPermission(props.objectId, 'idir', 'READ')
+          .then(() => {
+            switchVal.value = true;
+            toast.success('File set to Internal only', `"${props.objectName}" is now Internal only`);
+          })
+          .catch((e) => toast.error('Setting file to Internal only failed', e.response?.data.detail, { life: 0 }));
+      },
+      reject: () => (switchVal.value = false),
+      onHide: () => (switchVal.value = false)
+    });
+  } else
+    confirm.require({
+      message:
+        "Setting this file to private will remove 'Internal only' access. " +
+        'Only users with permissions will be able to view or download the file.',
+      header: 'Set file to private?',
+      acceptLabel: 'Set to private',
+      rejectLabel: 'Cancel',
+      accept: () => {
+        permissionStore
+          .deleteObjectIdpPermission(props.objectId, 'idir', 'READ')
+          .then(() => {
+            switchVal.value = false;
+            toast.success('File set to private', `"${props.objectName}" is no longer 'Internal only'`);
+          })
+          .catch((e) => toast.error('Setting file to private failed', e.response?.data.detail, { life: 0 }));
+      },
+      reject: () => (switchVal.value = true),
+      onHide: () => (switchVal.value = true)
+    });
+};
+
+onMounted(async () => {
+  await permissionStore.fetchObjectIdpPermissions({
+    objectId: props.objectId,
+    permCode: 'READ',
+    idp: 'idir'
+  });
+  await permissionStore.fetchBucketIdpPermissions({
+    bucketId: props.bucketId,
+    permCode: 'READ',
+    idp: 'idir'
+  });
+});
+</script>
+
+<template>
+  <span
+    v-tooltip="
+      isToggleEnabled
+        ? ''
+        : isPublic
+          ? 'Enabled by Public Sharing'
+          : 'Change the folder\'s \'Internal only\' setting to update this file'
+    "
+  >
+    <InputSwitch
+      :model-value="switchVal"
+      aria-label="Toggle to make file Internal only"
+      :disabled="!isToggleEnabled"
+      @update:model-value="toggleIdp($event)"
+    />
+  </span>
+</template>
diff --git a/frontend/src/components/object/ObjectList.vue b/frontend/src/components/object/ObjectList.vue
index d9894f7b..52437434 100644
--- a/frontend/src/components/object/ObjectList.vue
+++ b/frontend/src/components/object/ObjectList.vue
@@ -25,11 +25,13 @@ import type { Ref } from 'vue';
 type Props = {
   bucketId: string;
   isBucketPublic?: boolean;
+  isBucketInternal?: boolean;
 };
 
 const props = withDefaults(defineProps<Props>(), {
   bucketId: undefined,
-  isBucketPublic: undefined
+  isBucketPublic: undefined,
+  isBucketInternal: undefined
 });
 
 //const navStore = useNavStore();
@@ -90,7 +92,7 @@ const autoSync = async () => {
   const lastSyncDate = new Date(bucket?.lastSyncRequestedDate as string);
   const sinceLastSyncDate = differenceInSeconds(now, lastSyncDate);
 
-  // if havent synced for 24 hrs trigger autoSync
+  // if havent synced for 24 hrs trigger autoSync of JUST this folder level (not recursive)
   if (sinceLastSyncDate > autoMinimum) {
     await bucketStore.syncBucket(props.bucketId, false);
     syncStatus.value = 'Sync in progress';
@@ -118,7 +120,9 @@ const autoSync = async () => {
 
 onBeforeMount(async () => {
   // sync bucket if necessary
-  const hasRead = permissionStore.getBucketPermissions.filter((p) => p.permCode === Permissions.READ);
+  const hasRead = permissionStore.getBucketPermissions.filter(
+    (p) => p.permCode === Permissions.READ && p.bucketId === props.bucketId
+  );
   if (hasRead.length > 0) await autoSync();
 });
 </script>
@@ -180,7 +184,7 @@ onBeforeMount(async () => {
           "
         >
           <SyncButton
-            v-if="bucket && permissionStore.isBucketActionAllowed(bucket.bucketId, getUserId, Permissions.READ)"
+            v-if="bucket && permissionStore.isBucketActionAllowed(bucket.bucketId, getUserId, Permissions.MANAGE)"
             :disabled="syncButtonDisabled"
             :bucket-id="bucket?.bucketId"
             :mode="ButtonMode.BUTTON"
@@ -199,6 +203,7 @@ onBeforeMount(async () => {
           :key="objectTableKey"
           :bucket-id="props.bucketId"
           :is-bucket-public="props.isBucketPublic"
+          :is-bucket-internal-only="isBucketInternal"
           :object-info-id="objectInfoId"
           @show-object-info="showObjectInfo"
         />
diff --git a/frontend/src/components/object/ObjectPermission.vue b/frontend/src/components/object/ObjectPermission.vue
index 54eeec4c..7e62ab2b 100644
--- a/frontend/src/components/object/ObjectPermission.vue
+++ b/frontend/src/components/object/ObjectPermission.vue
@@ -3,7 +3,7 @@ import { storeToRefs } from 'pinia';
 import { computed, onBeforeMount, ref } from 'vue';
 import { FontAwesomeIcon } from '@fortawesome/vue-fontawesome';
 
-import { ObjectPermissionAddUser, ObjectPublicToggle } from '@/components/object';
+import { ObjectPermissionAddUser, ObjectPublicToggle, ObjectIdpToggle } from '@/components/object';
 import { BulkPermission } from '@/components/common';
 import { Button, Checkbox, Column, DataTable, TabPanel, TabView } from '@/lib/primevue';
 
@@ -40,7 +40,7 @@ const aggregatePermissionData = computed(() => {
     Object.values(
       data.reduce((acc, item) => {
         const baseUser = acc[item.userId] ?? {
-          idpName: item.idpName,
+          idp: item.idp,
           elevatedRights: item.elevatedRights,
           fullName: item.fullName,
           resource: 'object',
@@ -98,9 +98,10 @@ onBeforeMount(() => {
 <template>
   <TabView>
     <TabPanel header="Manage permissions">
+      <h3 class="mb-2">Sharing Access</h3>
       <div class="flex flex-row pb-3">
         <div class="flex-grow-1">
-          <h3 class="pb-1">Set to public</h3>
+          <h4 class="pb-1">Set to public</h4>
           <p>
             Setting a file to
             <strong>public</strong>
@@ -118,6 +119,24 @@ onBeforeMount(() => {
         />
       </div>
 
+      <div class="flex flex-row pb-3">
+        <div class="flex-grow-1">
+          <h4 class="pb-1">Internal only</h4>
+          <p>
+            Give access to
+            <strong>all IDIR users</strong>
+          </p>
+        </div>
+        <ObjectIdpToggle
+          v-if="object && getUserId"
+          :bucket-id="object.bucketId"
+          :object-id="object.id"
+          :object-name="object.name"
+          :object-public="object.public"
+          :user-id="getUserId"
+        />
+      </div>
+
       <h3 class="my-2">User Permissions</h3>
 
       <div v-if="!showSearchUsers">
@@ -167,7 +186,7 @@ onBeforeMount(() => {
           header="Name"
         />
         <Column
-          field="idpName"
+          field="idp"
           header="Provider"
         />
         <Column
@@ -186,7 +205,7 @@ onBeforeMount(() => {
                 input-id="read"
                 aria-label="read"
                 :binary="true"
-                :disabled="data.read.value"
+                :disabled="data.read.disabled"
                 @update:model-value="(value: boolean) => updateObjectPermission(value, data.userId, Permissions.READ)"
               />
             </span>
diff --git a/frontend/src/components/object/ObjectTable.vue b/frontend/src/components/object/ObjectTable.vue
index 5532cc90..d79dc61d 100644
--- a/frontend/src/components/object/ObjectTable.vue
+++ b/frontend/src/components/object/ObjectTable.vue
@@ -1,18 +1,12 @@
 <script setup lang="ts">
 import { storeToRefs } from 'pinia';
-import { onUnmounted, onMounted, ref } from 'vue';
+import { computed, onUnmounted, onMounted, ref } from 'vue';
 
 import { Spinner } from '@/components/layout';
-import {
-  DeleteObjectButton,
-  DownloadObjectButton,
-  ObjectFilters,
-  ObjectPermission,
-  ObjectPublicToggle
-} from '@/components/object';
+import { DeleteObjectButton, DownloadObjectButton, ObjectFilters, ObjectPermission } from '@/components/object';
 import { ShareButton } from '@/components/common';
-import { Button, Column, DataTable, Dialog, InputText } from '@/lib/primevue';
-import { useAuthStore, useObjectStore, useNavStore, usePermissionStore } from '@/store';
+import { Button, Column, DataTable, Dialog, InputText, Tag } from '@/lib/primevue';
+import { useAuthStore, useBucketStore, useObjectStore, useNavStore, usePermissionStore } from '@/store';
 import { Permissions, RouteNames } from '@/utils/constants';
 import { onDialogHide } from '@/utils/utils';
 import { ButtonMode } from '@/utils/enums';
@@ -35,13 +29,12 @@ type DataTableFilter = {
 };
 // Props
 type Props = {
-  bucketId?: string;
+  bucketId: string;
   isBucketPublic?: boolean;
   objectInfoId?: string;
 };
 
 const props = withDefaults(defineProps<Props>(), {
-  bucketId: undefined,
   isBucketPublic: undefined,
   objectInfoId: undefined
 });
@@ -50,6 +43,7 @@ const props = withDefaults(defineProps<Props>(), {
 const emit = defineEmits(['show-object-info']);
 
 // Store
+const bucketStore = useBucketStore();
 const objectStore = useObjectStore();
 const permissionStore = usePermissionStore();
 const { getUserId, getIsAuthenticated } = storeToRefs(useAuthStore());
@@ -71,6 +65,15 @@ const filters: Ref<DataTableFilter> = ref({
   meta: { value: undefined, matchMode: 'contains' }
 });
 
+// idp perms
+const isObjectInternal = computed(() => {
+  return (objId: any) => {
+    return permissionStore.getObjectInternal(objId);
+  };
+});
+const bucket = bucketStore.getBucket(props.bucketId);
+const isBucketInternal = permissionStore.getBucketInternal(props.bucketId);
+
 // Actions
 const formatShortUuid = (uuid: string) => uuid?.slice(0, 8) ?? uuid;
 const onObjectDeleted = () => {
@@ -117,7 +120,7 @@ const loadLazyData = (event?: any) => {
         limit: lazyParams.value.rows,
         sort: lazyParams.value.sortField,
         order: lazyParams.value.sortOrder === 1 ? 'asc' : 'desc',
-        public: !getIsAuthenticated.value ? true : undefined,
+        public: !getIsAuthenticated.value || bucket?.public ? true : undefined,
         tagset: getIsAuthenticated.value ? lazyParams.value?.filters?.tags.value : undefined
       },
       lazyParams.value?.filters?.meta.value //Header
@@ -139,6 +142,9 @@ const loadLazyData = (event?: any) => {
         permissionStore.fetchObjectPermissions({
           objectId: objects.map((o: COMSObject) => o.id)
         });
+        permissionStore.fetchObjectIdpPermissions({
+          objectId: objects.map((o: COMSObject) => o.id)
+        });
       }
     });
 };
@@ -278,7 +284,6 @@ async function downloadPublicObject(objectId: string) {
         field="name"
         sortable
         header="Name"
-        header-style="min-width: 25%"
         body-class="truncate"
       >
         <template #body="{ data }">
@@ -311,7 +316,7 @@ async function downloadPublicObject(objectId: string) {
         field="id"
         sortable
         header="Object ID"
-        style="width: 150px"
+        style="display: none"
       >
         <template #body="{ data }">
           <div
@@ -335,26 +340,34 @@ async function downloadPublicObject(objectId: string) {
       <Column
         v-if="getIsAuthenticated"
         field="publicSharing"
-        header="Public"
-        style="width: 100px"
+        header="Sharing"
+        style="width: 150px"
       >
         <template #body="{ data }">
-          <ObjectPublicToggle
-            v-if="props.bucketId && getUserId"
-            :bucket-id="props.bucketId"
-            :bucket-public="props.isBucketPublic"
-            :object-id="data.id"
-            :object-name="data.name"
-            :object-public="data.public"
-            :user-id="getUserId"
-          />
+          <div class="">
+            <Tag
+              v-if="data.public || bucket?.public"
+              value="Public"
+              severity="danger"
+              rounded
+              class="mb-1 min-w-100"
+            />
+
+            <Tag
+              v-if="!props.isBucketPublic && !data.public && (isBucketInternal || isObjectInternal(data.id))"
+              value="Internal (IDIR)"
+              severity="info"
+              rounded
+              class="mb-1 min-w-100"
+            />
+          </div>
         </template>
       </Column>
       <Column
         header="Actions"
-        :header-style="getIsAuthenticated ? 'min-width: 270px' : 'width: 40px'"
         header-class="header-right"
         body-class="action-buttons"
+        style="width: 200px"
       >
         <template #body="{ data }">
           <DownloadObjectButton
diff --git a/frontend/src/components/object/index.ts b/frontend/src/components/object/index.ts
index a7a9b166..6898cf49 100644
--- a/frontend/src/components/object/index.ts
+++ b/frontend/src/components/object/index.ts
@@ -5,6 +5,7 @@ export { default as DownloadObjectButton } from './DownloadObjectButton.vue';
 export { default as ObjectAccess } from './ObjectAccess.vue';
 export { default as ObjectFileDetails } from './ObjectFileDetails.vue';
 export { default as ObjectFilters } from './ObjectFilters.vue';
+export { default as ObjectIdpToggle } from './ObjectIdpToggle.vue';
 export { default as ObjectList } from './ObjectList.vue';
 export { default as ObjectMetadata } from './ObjectMetadata.vue';
 export { default as ObjectMetadataTagForm } from './ObjectMetadataTagForm.vue';
diff --git a/frontend/src/services/bucketService.ts b/frontend/src/services/bucketService.ts
index e6256f5c..2b4ce0f6 100644
--- a/frontend/src/services/bucketService.ts
+++ b/frontend/src/services/bucketService.ts
@@ -31,6 +31,8 @@ export default {
       if (params.active !== undefined) urlLimit -= '&active=false'.length;
       if (params.key) urlLimit -= `&key=${encodeURIComponent(params.key)}`.length;
       if (params.bucketName) urlLimit -= `&bucketName=${encodeURIComponent(params.bucketName)}`.length;
+      if (params.bucket) urlLimit -= `&bucket=${encodeURIComponent(params.bucket)}`.length;
+      if (params.endpoint) urlLimit -= `&endpoint=${encodeURIComponent(params.endpoint)}`.length;
 
       // account for bucketId param
       const BUCKET_ID_PARAM_LENGTH = '&bucketId[]='.length + 36; // uuidv4's have 36 chars, including dashes
diff --git a/frontend/src/services/permissionService.ts b/frontend/src/services/permissionService.ts
index 9f64d07d..43fad850 100644
--- a/frontend/src/services/permissionService.ts
+++ b/frontend/src/services/permissionService.ts
@@ -14,8 +14,10 @@ import type {
 const PATH = 'permission';
 const BUCKET = 'bucket';
 const OBJECT = 'object';
+const IDP = 'idp';
 
 export default {
+  // ------ user permissions ------
   /**
    * @function bucketAddPermissions
    * Adds the given permissions to the bucket
@@ -104,5 +106,98 @@ export default {
    */
   objectGetPermissions(objectId: string, params?: ObjectGetPermissionsOptions) {
     return comsAxios().get(`${PATH}/${OBJECT}/${objectId}`, { params: params });
+  },
+
+  // ------ IDP permissions ------
+
+  /**
+   * function bucketAddIdpPermissions
+   * Adds the given permissions to the bucket for the specified IDP
+   * @param bucketId
+   * @param data
+   * @param params
+   * @returns
+   */
+  bucketAddIdpPermissions(bucketId: string, data: any, params = { recursive: false }) {
+    return comsAxios().put(`${PATH}/${IDP}/${BUCKET}/${bucketId}`, data, {
+      params: params
+    });
+  },
+
+  /**
+   * function bucketDeleteIdpPermission
+   * Deletes the given permission from the bucket for the specified IDP
+   * @param bucketId
+   * @param params
+   * @returns
+   */
+  bucketDeleteIdpPermission(bucketId: string, params: any) {
+    return comsAxios().delete(`${PATH}/${IDP}/${BUCKET}/${bucketId}`, {
+      params: params
+    });
+  },
+
+  /**
+   * @function bucketSearchIdpPermissions
+   * Returns a list of buckets and their IDP permissions
+   * @param {BucketSearchPermissionsOptions} params Optional object containing the data to filter against
+   * @returns {Promise} An axios response
+   */
+  bucketSearchIdpPermissions(params?: any) {
+    return comsAxios().get(`${PATH}/${IDP}/${BUCKET}`, { params: params });
+  },
+
+  /**
+   * function bucketGetIdpPermissions
+   * Returns a list of IDP permissions for the bucket
+   * @param bucketId
+   * @param params
+   * @returns
+   */
+  bucketGetIdpPermissions(bucketId: string, params?: any) {
+    return comsAxios().get(`${PATH}/${IDP}/${BUCKET}/${bucketId}`, { params: params });
+  },
+
+  /**
+   * function objectAddIdpPermissions
+   * Adds the given permissions to the object for the specified IDP
+   * @param objectId
+   * @param data
+   * @returns
+   */
+  objectAddIdpPermissions(objectId: string, data: Object) {
+    return comsAxios().put(`${PATH}/${IDP}/${OBJECT}/${objectId}`, data);
+  },
+
+  /**
+   * @function objectDeleteIdpPermission
+   * Deletes the given IDP permission from the object
+   * @param {string} objectId ID of the object to remove permissions from
+   * @param {ObjectDeletePermissionsOptions} params Object containing the permission to remove
+   * @returns {Promise} An axios response
+   */
+  objectDeleteIdpPermission(objectId: string, params: Object) {
+    return comsAxios().delete(`${PATH}/${IDP}/${OBJECT}/${objectId}`, { params: params });
+  },
+
+  /**
+   * @function objectSearchIdpPermissions
+   * Returns a list of IDP object permissions
+   * @param {ObjectSearchPermissionsOptions} params Optional object containing the data to filter against
+   * @returns {Promise} An axios response
+   */
+  objectSearchIdpPermissions(params?: any) {
+    return comsAxios().get(`${PATH}/${IDP}/${OBJECT}`, { params: params });
+  },
+
+  /**
+   * @function objectGetIdpPermissions
+   * Returns a list of IDP permissions for the object
+   * @param {string} objectId ID of the object
+   * @param {ObjectGetPermissionsOptions} params Optional object containing the data to filter against
+   * @returns {Promise} An axios response
+   */
+  objectGetIdpPermissions(objectId: string, params?: Object) {
+    return comsAxios().get(`${PATH}/${IDP}/${OBJECT}/${objectId}`, { params: params });
   }
 };
diff --git a/frontend/src/store/bucketStore.ts b/frontend/src/store/bucketStore.ts
index f8077948..41721b9d 100644
--- a/frontend/src/store/bucketStore.ts
+++ b/frontend/src/store/bucketStore.ts
@@ -95,8 +95,8 @@ export const useBucketStore = defineStore('bucket', () => {
   /**
    * function does the following in order:
    * - fetches bucket permissions
-   *   (fetchBucketPermissions() also add bucket permissions to the permission store)
-   * - pass bucketId's of buckets with a permission to searchBuckets()
+   * - adds bucket permissions to the permission store
+   * - pass bucketId's (from list of permissions) to searchBuckets()
    * - add buckets to store (skipping existing matches)
    * @param params search parameters
    * @returns an array of matching buckets found
@@ -106,11 +106,21 @@ export const useBucketStore = defineStore('bucket', () => {
       appStore.beginIndeterminateLoading();
 
       // Get a unique list of bucket IDs the user has access to
-      const permResponse = await permissionStore.fetchBucketPermissions(params);
+      // based on user permissions..
+      const permResponse = await permissionStore.fetchBucketPermissions({ ...params, idp: undefined });
+      //  and check IDP permissions (if current user's idp is provided in params)
+      const IdpPermResponse = params?.idp
+        ? await permissionStore.fetchBucketIdpPermissions({ ...params, userId: undefined })
+        : undefined;
+
       // if permissions found
-      if (permResponse) {
+      if (permResponse || IdpPermResponse) {
         const uniqueIds: Array<string> = [
-          ...new Set<string>(permResponse.map((x: { bucketId: string }) => x.bucketId))
+          ...new Set<string>(
+            permResponse
+              ?.map((x: { bucketId: string }) => x.bucketId)
+              .concat(IdpPermResponse?.map((x: { bucketId: string }) => x.bucketId) || [])
+          )
         ];
 
         let response = Array<Bucket>();
diff --git a/frontend/src/store/objectStore.ts b/frontend/src/store/objectStore.ts
index 199475cc..d559e01c 100644
--- a/frontend/src/store/objectStore.ts
+++ b/frontend/src/store/objectStore.ts
@@ -144,13 +144,19 @@ export const useObjectStore = defineStore('object', () => {
       appStore.beginIndeterminateLoading();
 
       // Get a unique list of object IDs the user has access to
-      const permResponse = await permissionStore.fetchObjectPermissions(params);
-
-      if (permResponse) {
+      // based on user permissions..
+      const permResponse = await permissionStore.fetchObjectPermissions({ ...params, idp: undefined });
+      //  and IDP permissions (if current user's idp is provided in params)
+      const IdpPermResponse = params?.idp
+        ? await permissionStore.fetchObjectIdpPermissions({ ...params, userId: undefined })
+        : undefined;
+      // if permissions found
+      if (permResponse || IdpPermResponse) {
         const uniqueIds: Array<string> = [
           ...new Set<string>(
             permResponse
-              .map((x: { objectId: string }) => x.objectId)
+              ?.map((x: { objectId: string }) => x.objectId)
+              .concat(IdpPermResponse?.map((x: { objectId: string }) => x.objectId) || [])
               // Resolve API returning all objects with bucketPerms=true even when requesting single objectId
               .filter((objectId: string) => !params.objectId || objectId === params.objectId)
           )
diff --git a/frontend/src/store/permissionStore.ts b/frontend/src/store/permissionStore.ts
index 5bc0aaf8..f170baf9 100644
--- a/frontend/src/store/permissionStore.ts
+++ b/frontend/src/store/permissionStore.ts
@@ -10,20 +10,28 @@ import { partition } from '@/utils/utils';
 import type { Ref } from 'vue';
 import type {
   BucketPermission,
+  BucketIdpPermission,
   BucketSearchPermissionsOptions,
   COMSObjectPermission,
+  COMSObjectIdpPermission,
   ObjectSearchPermissionsOptions,
   IdentityProvider,
   Permission,
   User,
   UserPermissions
+  // IdpPermissions
 } from '@/types';
 
 export type PermissionStoreState = {
+  // user permissions
   bucketPermissions: Ref<Array<BucketPermission>>;
   mappedBucketToUserPermissions: Ref<Array<UserPermissions>>;
   mappedObjectToUserPermissions: Ref<Array<UserPermissions>>;
   objectPermissions: Ref<Array<COMSObjectPermission>>;
+  // IDP permissions
+  bucketIdpPermissions: Ref<any>;
+  objectIdpPermissions: Ref<any>;
+  // general permissions
   permissions: Ref<Array<Permission>>;
 };
 
@@ -36,15 +44,22 @@ export const usePermissionStore = defineStore('permission', () => {
 
   // State
   const state: PermissionStoreState = {
+    // user permissions
     bucketPermissions: ref([]),
     mappedBucketToUserPermissions: ref([]),
     mappedObjectToUserPermissions: ref([]),
     objectPermissions: ref([]),
+    // IDP permissions
+    bucketIdpPermissions: ref([]),
+    objectIdpPermissions: ref([]),
+    // general permissions
     permissions: ref([])
   };
 
   // Getters
   const getters = {
+    // User permissions getters
+    getObjectPermissions: computed(() => state.objectPermissions.value),
     getBucketPermissions: computed(() => state.bucketPermissions.value),
     getMappedBucketToUserPermissions: computed(() => state.mappedBucketToUserPermissions.value),
     getMappedObjectToUserPermissions: computed(() => state.mappedObjectToUserPermissions.value),
@@ -57,7 +72,36 @@ export const usePermissionStore = defineStore('permission', () => {
       });
       return op.concat(bp);
     }),
-    getObjectPermissions: computed(() => state.objectPermissions.value),
+    // IDP permissions getters
+    getObjectIdpPermissions: computed(() => state.objectIdpPermissions.value),
+    getObjectInternal: computed(() => (objectId: string) => {
+      return (
+        state.objectIdpPermissions.value.filter(
+          (p: any) => p.objectId === objectId && p.idp === 'idir' && p.permCode === 'READ'
+        ).length > 0
+      );
+    }),
+    getBucketIdpPermissions: computed(() => state.bucketIdpPermissions.value),
+    // is object/bucket 'internal' (READ perm for all IDI users)
+    getBucketInternal: computed(() => (bucketId: string) => {
+      return (
+        state.bucketIdpPermissions.value.filter(
+          (p: any) => p.bucketId === bucketId && p.idp === 'idir' && p.permCode === 'READ'
+        ).length > 0
+      );
+    }),
+    getInternal: computed(() => (object: any) => {
+      const objPerm =
+        state.objectIdpPermissions.value.filter(
+          (p: any) => p.objectId === object.id && p.idp === 'idir' && p.permCode === 'READ'
+        ).length > 0;
+      const bucketPerm =
+        state.bucketIdpPermissions.value.filter(
+          (p: any) => p.bucketId === object.bucketId && p.idp === 'idir' && p.permCode === 'READ'
+        ).length > 0;
+      return objPerm || bucketPerm;
+    }),
+    // General permissions getters
     getPermissions: computed(() => state.permissions.value)
   };
 
@@ -70,7 +114,7 @@ export const usePermissionStore = defineStore('permission', () => {
     } catch (error: any) {
       toast.error('Adding bucket permission', error.response?.data.detail ?? error, { life: 0 });
     } finally {
-      await fetchBucketPermissions({ bucketId: bucketId });
+      await fetchBucketPermissions({ userId: userId });
       await mapBucketToUserPermissions(bucketId);
       appStore.endIndeterminateLoading();
     }
@@ -97,6 +141,33 @@ export const usePermissionStore = defineStore('permission', () => {
     }
   }
 
+  async function addBucketIdpPermission(bucketId: string, idp: string, permCode: string): Promise<void> {
+    try {
+      appStore.beginIndeterminateLoading();
+      // note: permission changes always cascade to subfolders for which current user has MANAGE permission
+      await permissionService.bucketAddIdpPermissions(bucketId, [{ idp, permCode }], { recursive: true });
+    } catch (error: any) {
+      toast.error('Adding bucket IDP permission', error.response?.data.detail ?? error, { life: 0 });
+    } finally {
+      await fetchBucketIdpPermissions();
+      // await mapBucketToIdpPermissions(bucketId);
+      appStore.endIndeterminateLoading();
+    }
+  }
+
+  async function addObjectIdpPermission(objectId: string, idp: string, permCode: string): Promise<void> {
+    try {
+      appStore.beginIndeterminateLoading();
+      await permissionService.objectAddIdpPermissions(objectId, [{ idp, permCode }]);
+    } catch (error: any) {
+      toast.error('Adding object IDP permission', error.response?.data.detail ?? error, { life: 0 });
+    } finally {
+      await fetchObjectIdpPermissions({ objectId: objectId });
+      // await mapObjectToIdpPermissions(objectId);
+      appStore.endIndeterminateLoading();
+    }
+  }
+
   function addObjectUser(user: UserPermissions): void {
     try {
       getters.getMappedObjectToUserPermissions.value.push(user);
@@ -113,7 +184,7 @@ export const usePermissionStore = defineStore('permission', () => {
     } catch (error: any) {
       toast.error('Deleting bucket permission', error.response?.data.detail ?? error, { life: 0 });
     } finally {
-      await fetchBucketPermissions({ bucketId: bucketId });
+      await fetchBucketPermissions({ userId: userId });
       await mapBucketToUserPermissions(bucketId);
       appStore.endIndeterminateLoading();
     }
@@ -132,6 +203,33 @@ export const usePermissionStore = defineStore('permission', () => {
     }
   }
 
+  async function deleteBucketIdpPermission(bucketId: string, idp: string, permCode: string): Promise<void> {
+    try {
+      appStore.beginIndeterminateLoading();
+      // note: permission changes always cascade to subfolders for which current user has MANAGE permission
+      await permissionService.bucketDeleteIdpPermission(bucketId, { idp, permCode, recursive: true });
+    } catch (error: any) {
+      toast.error('Deleting bucket IDP permission', error.response?.data.detail ?? error, { life: 0 });
+    } finally {
+      await fetchBucketIdpPermissions();
+      // await mapBucketToIdpPermissions(bucketId);
+      appStore.endIndeterminateLoading();
+    }
+  }
+
+  async function deleteObjectIdpPermission(objectId: string, idp: string, permCode: string): Promise<void> {
+    try {
+      appStore.beginIndeterminateLoading();
+      await permissionService.objectDeleteIdpPermission(objectId, { idp, permCode });
+    } catch (error: any) {
+      toast.error('Deleting object IDP permission', error.response?.data.detail ?? error, { life: 0 });
+    } finally {
+      await fetchObjectIdpPermissions({ objectId: objectId }); //
+      // await mapObjectToIdpPermissions(objectId);
+      appStore.endIndeterminateLoading();
+    }
+  }
+
   async function fetchBucketPermissions(
     params: BucketSearchPermissionsOptions = {}
   ): Promise<Array<BucketPermission> | void> {
@@ -143,7 +241,7 @@ export const usePermissionStore = defineStore('permission', () => {
 
       // patch bucketPermissions state with latest perms from COMS
       const matches = (x: BucketPermission) =>
-        (!params.bucketId || x.bucketId === params.bucketId) &&
+        (!params.bucketId || x.bucketId === params.bucketId || params.bucketId.includes(x.bucketId)) &&
         (!params.userId || x.userId === params.userId) &&
         (!params.permCode || x.permCode === params.permCode);
       const [, difference] = partition(state.bucketPermissions.value, matches);
@@ -170,7 +268,7 @@ export const usePermissionStore = defineStore('permission', () => {
 
       // patch objectPermissions state with latest perms from COMS
       const matches = (x: COMSObjectPermission) =>
-        (!params.objectId || x.objectId === params.objectId) &&
+        (!params.objectId || x.objectId === params.objectId || params.objectId.includes(x.objectId)) &&
         (!params.userId || x.userId === params.userId) &&
         (!params.permCode || x.permCode === params.permCode);
       const [, difference] = partition(state.objectPermissions.value, matches);
@@ -186,21 +284,37 @@ export const usePermissionStore = defineStore('permission', () => {
   }
 
   function isBucketActionAllowed(bucketId: string, userId?: string, permCode?: string): boolean {
-    return state.bucketPermissions.value.some(
+    // check user permissions
+    const userPerm = state.bucketPermissions.value.some(
       (x: BucketPermission) => x.bucketId === bucketId && x.userId === userId && x.permCode === permCode
     );
+    // check idp permissions
+    const idp = getProfile.value?.identity_provider;
+    const idpPerm = state.bucketIdpPermissions.value.some(
+      (x: BucketIdpPermission) => x.bucketId === bucketId && x.idp === idp && x.permCode === permCode
+    );
+
+    return userPerm || idpPerm;
   }
 
   function isObjectActionAllowed(objectId: string, userId?: string, permCode?: string, bucketId?: string): boolean {
-    const bucketPerm = state.bucketPermissions.value.some(
+    // check user permissions
+    const bucketUserPerm = state.bucketPermissions.value.some(
       (x: BucketPermission) => x.bucketId === bucketId && x.userId === userId && x.permCode === permCode
     );
-
-    const objectPerm = state.objectPermissions.value.some(
+    const objectUserPerm = state.objectPermissions.value.some(
       (x: COMSObjectPermission) => x.objectId === objectId && x.userId === userId && x.permCode === permCode
     );
+    // check idp permissions
+    const idp = getProfile.value?.identity_provider;
+    const bucketIdpPerm = state.bucketIdpPermissions.value.some(
+      (x: BucketIdpPermission) => x.bucketId === bucketId && x.idp === idp && x.permCode === permCode
+    );
+    const objectIdpPerm = state.objectIdpPermissions.value.some(
+      (x: COMSObjectIdpPermission) => x.objectId === objectId && x.idp === idp && x.permCode === permCode
+    );
 
-    return bucketPerm || objectPerm;
+    return bucketUserPerm || objectUserPerm || bucketIdpPerm || objectIdpPerm;
   }
 
   function isUserElevatedRights(): boolean {
@@ -226,12 +340,12 @@ export const usePermissionStore = defineStore('permission', () => {
       uniqueUsers.forEach((user: User) => {
         const configuredIdp = getConfig.value.idpList.find((idp: IdentityProvider) => idp.idp === user.idp);
         // If IDP is not specified in our IDP list config, assume it's BC Services Card
-        const idpName = configuredIdp?.name || 'BCSC';
+        const idp = configuredIdp?.name || 'BCSC';
         const idpElevated = configuredIdp?.elevatedRights || false;
 
         userPermissions.push({
           userId: user.userId,
-          idpName: idpName,
+          idp: idp,
           elevatedRights: idpElevated,
           fullName: user.fullName,
           create: hasPermission(user.userId, Permissions.CREATE),
@@ -265,12 +379,12 @@ export const usePermissionStore = defineStore('permission', () => {
       uniqueUsers.forEach((user: User) => {
         const configuredIdp = getConfig.value.idpList.find((idp: IdentityProvider) => idp.idp === user.idp);
         // If IDP is not specified in our IDP list config, assume it's BC Services Card
-        const idpName = configuredIdp?.name || 'BCSC';
+        const idp = configuredIdp?.name || 'BCSC';
         const idpElevated = configuredIdp?.elevatedRights || false;
 
         userPermissions.push({
           userId: user.userId,
-          idpName: idpName,
+          idp: idp,
           elevatedRights: idpElevated,
           fullName: user.fullName,
           create: hasPermission(user.userId, Permissions.CREATE),
@@ -289,6 +403,49 @@ export const usePermissionStore = defineStore('permission', () => {
     }
   }
 
+  async function fetchBucketIdpPermissions(params: any = {}): Promise<Array<any> | undefined> {
+    try {
+      appStore.beginIndeterminateLoading();
+
+      const response = (await permissionService.bucketSearchIdpPermissions(params)).data;
+      const newPerms: Array<any> = response.flatMap((x: any) => x.permissions);
+      // patch bucketIdpPermissions state with latest perms from COMS
+      const matches = (x: any) =>
+        (!params.bucketId || x.bucketId === params.bucketId || params.bucketId.includes(x.bucketId)) &&
+        (!params.idp || x.idp === params.idp) &&
+        (!params.permCode || x.permCode === params.permCode);
+      const [, difference] = partition(state.bucketIdpPermissions.value, matches);
+      state.bucketIdpPermissions.value = difference.concat(newPerms);
+      // Pass response back so bucketStore can handle bucketPerms=true correctly
+      return response;
+    } catch (error: any) {
+      toast.error('Fetching bucket IDP permissions', error.response?.data.detail ?? error, { life: 0 });
+    } finally {
+      appStore.endIndeterminateLoading();
+    }
+  }
+
+  async function fetchObjectIdpPermissions(params: any = {}): Promise<Array<any> | undefined> {
+    try {
+      appStore.beginIndeterminateLoading();
+      const response = (await permissionService.objectSearchIdpPermissions(params)).data;
+      const newPerms: Array<any> = response.flatMap((x: any) => x.permissions);
+      // patch objectIdpPermissions state with latest perms from COMS
+      const matches = (x: any) =>
+        (!params.objectId || x.objectId === params.objectId || params.objectId.includes(x.objectId)) &&
+        (!params.idp || x.idp === params.idp) &&
+        (!params.permCode || x.permCode === params.permCode);
+      const [, difference] = partition(state.objectIdpPermissions.value, matches);
+      state.objectIdpPermissions.value = difference.concat(newPerms);
+      // Pass response back so objectStore can handle bucketPerms=true correctly
+      return response;
+    } catch (error: any) {
+      toast.error('Fetching object permissions', error.response?.data.detail ?? error, { life: 0 });
+    } finally {
+      appStore.endIndeterminateLoading();
+    }
+  }
+
   async function removeBucketUser(bucketId: string, userId: string): Promise<void> {
     try {
       appStore.beginIndeterminateLoading();
@@ -358,7 +515,13 @@ export const usePermissionStore = defineStore('permission', () => {
     mapBucketToUserPermissions,
     mapObjectToUserPermissions,
     removeBucketUser,
-    removeObjectUser
+    removeObjectUser,
+    addBucketIdpPermission,
+    addObjectIdpPermission,
+    fetchObjectIdpPermissions,
+    fetchBucketIdpPermissions,
+    deleteBucketIdpPermission,
+    deleteObjectIdpPermission
   };
 });
 
diff --git a/frontend/src/types/BucketIdpPermission.ts b/frontend/src/types/BucketIdpPermission.ts
new file mode 100644
index 00000000..2e2cd2a3
--- /dev/null
+++ b/frontend/src/types/BucketIdpPermission.ts
@@ -0,0 +1,8 @@
+import type { IAudit } from '@/interfaces';
+
+export type BucketIdpPermission = {
+  bucketId: string;
+  id: string;
+  permCode: string;
+  idp: string;
+} & IAudit;
diff --git a/frontend/src/types/COMSObjectIdpPermission.ts b/frontend/src/types/COMSObjectIdpPermission.ts
new file mode 100644
index 00000000..863ad000
--- /dev/null
+++ b/frontend/src/types/COMSObjectIdpPermission.ts
@@ -0,0 +1,8 @@
+import type { IAudit } from '@/interfaces';
+
+export type COMSObjectIdpPermission = {
+  id: string;
+  objectId: string;
+  permCode: string;
+  idp: string;
+} & IAudit;
diff --git a/frontend/src/types/IdpPermissions.ts b/frontend/src/types/IdpPermissions.ts
new file mode 100644
index 00000000..515c5cd7
--- /dev/null
+++ b/frontend/src/types/IdpPermissions.ts
@@ -0,0 +1,8 @@
+export type IdpPermissions = {
+  idp: string;
+  create?: boolean;
+  read: boolean;
+  update: boolean;
+  delete: boolean;
+  manage: boolean;
+};
diff --git a/frontend/src/types/UserPermissions.ts b/frontend/src/types/UserPermissions.ts
index 2c983114..41e5e95a 100644
--- a/frontend/src/types/UserPermissions.ts
+++ b/frontend/src/types/UserPermissions.ts
@@ -1,6 +1,6 @@
 export type UserPermissions = {
   userId: string;
-  idpName?: string;
+  idp?: string;
   elevatedRights?: boolean;
   fullName: string;
   create?: boolean;
diff --git a/frontend/src/types/index.ts b/frontend/src/types/index.ts
index 6bac653d..8d800dd2 100644
--- a/frontend/src/types/index.ts
+++ b/frontend/src/types/index.ts
@@ -3,7 +3,10 @@ export type { BucketPermission } from './BucketPermission';
 export type { BucketTreeNode, BucketTreeNodeData } from './BucketTreeNode';
 export type { COMSObject } from './COMSObject';
 export type { COMSObjectPermission } from './COMSObjectPermission';
+export type { COMSObjectIdpPermission } from './COMSObjectIdpPermission';
 export type { IdentityProvider } from './IdentityProvider';
+export type { IdpPermissions } from './IdpPermissions';
+export type { BucketIdpPermission } from './BucketIdpPermission';
 export type { InviteCreateOptions } from './InviteCreateOptions';
 export type { Metadata } from './Metadata';
 export type { MetadataPair } from './MetadataPair';
diff --git a/frontend/src/types/options/BucketSearchPermissionsOptions.ts b/frontend/src/types/options/BucketSearchPermissionsOptions.ts
index da96a983..653f2214 100644
--- a/frontend/src/types/options/BucketSearchPermissionsOptions.ts
+++ b/frontend/src/types/options/BucketSearchPermissionsOptions.ts
@@ -3,4 +3,5 @@ export type BucketSearchPermissionsOptions = {
   objectPerms?: boolean;
   permCode?: string;
   userId?: string;
+  idp?: string;
 };
diff --git a/frontend/src/types/options/ObjectSearchPermissionsOptions.ts b/frontend/src/types/options/ObjectSearchPermissionsOptions.ts
index f04a793d..e0926dd4 100644
--- a/frontend/src/types/options/ObjectSearchPermissionsOptions.ts
+++ b/frontend/src/types/options/ObjectSearchPermissionsOptions.ts
@@ -4,8 +4,9 @@ export type ObjectSearchPermissionsOptions = {
   objectId?: string | Array<string>;
   permCode?: string;
   userId?: string;
-  limit?: number,
-  sort?: string,
-  order?: string,
-  page?: number
+  idp?: string;
+  limit?: number;
+  sort?: string;
+  order?: string;
+  page?: number;
 };
diff --git a/frontend/src/types/options/SearchBucketsOptions.ts b/frontend/src/types/options/SearchBucketsOptions.ts
index af6f7fe9..437d3e35 100644
--- a/frontend/src/types/options/SearchBucketsOptions.ts
+++ b/frontend/src/types/options/SearchBucketsOptions.ts
@@ -1,6 +1,8 @@
 export type SearchBucketsOptions = {
   bucketId?: Array<string>;
   bucketName?: string;
+  bucket?: string;
+  endpoint?: string;
   key?: string;
   active?: boolean;
 };
diff --git a/frontend/src/utils/utils.ts b/frontend/src/utils/utils.ts
index 82761a60..69138997 100644
--- a/frontend/src/utils/utils.ts
+++ b/frontend/src/utils/utils.ts
@@ -143,6 +143,19 @@ export function getLastSegment(path: string) {
   return p.slice(p.lastIndexOf('/') + 1);
 }
 
+/**
+ * @function getPenultimateSegment
+ * Returns the second last segment of a path, ignoring trailing slashes
+ * @param {string} path full path (eg: http://abc.com/bucket/test)
+ * @returns {string | undefined} last segment of a path (eg: bucket)
+ */
+export function getParentKey(path: string) {
+  if (path === '/') return undefined;
+  const segments = path.split('/');
+  const filteredSegments = segments.filter((segment) => segment.length > 0);
+  return filteredSegments.length > 1 ? filteredSegments.slice(0, -1).join('/') : '/';
+}
+
 /**
  * @function onDialogHide
  * Return focus to the button which trigger model visibility
diff --git a/frontend/src/views/list/ListObjectsView.vue b/frontend/src/views/list/ListObjectsView.vue
index 2c29deb3..58584296 100644
--- a/frontend/src/views/list/ListObjectsView.vue
+++ b/frontend/src/views/list/ListObjectsView.vue
@@ -26,7 +26,7 @@ const props = withDefaults(defineProps<Props>(), {
 
 // Store
 const bucketStore = useBucketStore();
-const { getUserId, getIsAuthenticated } = storeToRefs(useAuthStore());
+const { getProfile, getUserId, getIsAuthenticated } = storeToRefs(useAuthStore());
 const permissionStore = usePermissionStore();
 const toast = useToast();
 const { focusedElement } = storeToRefs(useNavStore());
@@ -48,6 +48,16 @@ const isBucketPublic = computed(() => {
 watch(isBucketPublic, () => remountComponent());
 const componentKey = ref(0);
 const remountComponent = () => (componentKey.value += 1);
+// make internal only flag reactive
+const isInternal = computed(() => {
+  const perms = (permissionStore.getBucketIdpPermissions ?? []).filter(
+    (p: any) => p.bucketId === props.bucketId && p.idp === 'idir' && p.permCode === 'READ'
+  );
+  return perms.length > 0;
+});
+// on isInternal change, re-mount ObjectList
+watch(isInternal, () => remountComponent());
+
 // show permissions modal
 const showPermissions = async (bucketId: string, bucketName: string) => {
   permissionsVisible.value = true;
@@ -97,15 +107,22 @@ onErrorCaptured((e: Error) => {
 onBeforeMount(async () => {
   const router = useRouter();
 
-  // fetch bucket; populate bucket and permissions in store
   let bucketResponse: any = [];
   if (props?.bucketId) {
+    // if logged in, fetch bucket; populate bucket and permissions in store
     if (getIsAuthenticated.value) {
-      bucketResponse = await bucketStore.fetchBuckets({
-        bucketId: props.bucketId,
-        userId: getUserId.value,
-        objectPerms: true
-      });
+      const bucket = await bucketStore.fetchBucket(props.bucketId);
+      if (bucket.public) {
+        bucketResponse = [bucket];
+      } else {
+        // get bucket permitted through User perms
+        bucketResponse = await bucketStore.fetchBuckets({
+          bucketId: props.bucketId,
+          userId: getUserId.value,
+          idp: (getProfile.value as any)?.identity_provider,
+          objectPerms: true
+        });
+      }
     } else {
       bucketResponse = [await bucketStore.fetchBucket(props.bucketId)];
     }
@@ -135,13 +152,15 @@ onBeforeMount(async () => {
         <span class="ml-3 flex align-items-center">
           <Tag
             v-if="isBucketPublic"
-            v-tooltip="
-              'This folder and its contents are set to public. Change the settings in &quot;Folder permissions.&quot;'
-            "
             value="Public"
             severity="danger"
             rounded
-            icon="pi pi-info-circle"
+          />
+          <Tag
+            v-else-if="isInternal"
+            value="Internal (IDIR)"
+            severity="info"
+            rounded
           />
         </span>
       </span>
@@ -187,6 +206,7 @@ onBeforeMount(async () => {
       :key="componentKey"
       :bucket-id="props.bucketId"
       :is-bucket-public="isBucketPublic"
+      :is-bucket-internal-only="isInternal"
     />
   </div>