SharePoint External Sharing and Guest Policies

SharePoint external sharing allows users in your organization to share content (sites, folders, files) with people outside your Azure AD tenant. This is a key collaboration feature but also a security boundary. External sharing is controlled at three levels: tenant, site collection, and item. The most restrictive setting wins.

External sharing enables collaboration with partners, vendors, and customers without requiring them to have an Azure AD account in your tenant. It reduces friction but introduces risk of data leakage. Microsoft provides granular controls to balance usability and security.

When a user shares a file with an external email address, SharePoint generates a sharing link. The link type depends on the sharing settings: - Anyone links: Anonymous, no authentication required. Anyone with the link can access the item. Default expiration is 30 days (configurable). - New and existing guests: External users must authenticate using a Microsoft account or Azure AD guest account. If the user is new, an invitation is sent to join the tenant as a guest. - Existing guests: Only users who already have a guest account in your Azure AD can access. - Only people in your organization: No external sharing.

When an external user clicks a sharing link, SharePoint checks: 1. Is the link valid (not expired or revoked)? 2. Is the user authenticated (if required)? 3. Does the user have permissions to the item? 4. Does the user have the 're-share' permission?

Tenant-level settings (SharePoint admin center > Sharing):

Site-level settings (Site Settings > Sharing):

Item-level settings (Share dialog):

To configure tenant-level sharing via PowerShell:

Set-SPOTenant -SharingCapability ExternalUserAndGuestSharing
Set-SPOTenant -DefaultSharingLinkType AnonymousLink
Set-SPOTenant -AnonymousLinkExpirationInDays 30
Set-SPOTenant -GuestSharingGroupAllowList @("contoso.com")

To verify current settings:

Get-SPOTenant | Select SharingCapability, DefaultSharingLinkType, AnonymousLinkExpirationInDays

To configure site-level sharing:

Set-SPOSite -Identity https://contoso.sharepoint.com/sites/project -SharingCapability ExternalUserSharingOnly

External sharing relies on Azure AD B2B collaboration. When you invite a new guest, an Azure AD guest user object is created. The guest must accept the invitation and sign in with their work, school, or Microsoft account. Guest users have limited Azure AD capabilities (e.g., no access to Teams unless explicitly granted).

SharePoint sites connected to Microsoft 365 Groups inherit sharing settings from the Group. Group settings for guest access are configured in Azure AD or Teams admin center. If a Group allows guests, the connected SharePoint site allows guests (subject to tenant and site settings).

Sensitivity labels can enforce encryption or restrict sharing. For example, a label with 'Let users assign permissions' can override SharePoint sharing defaults. Labels can also block external sharing entirely.

Azure AD Conditional Access policies apply to guest users if configured. For example, you can require MFA for all guest access or block access from specific countries.

All external sharing events are logged in the unified audit log. Key events: 'Shared an item externally', 'Invited external users', 'Accepted external invitation'. Admins can search these logs in the compliance center or via PowerShell.

A large enterprise works with a single partner company 'partner.com'. They want to allow external sharing only to that domain. The admin configures tenant-level domain allow list: 'partner.com'. They set sharing capability to 'New and existing guests' to require authentication. Site owners can share with any email address, but only those with '@partner.com' domain will receive the invitation; others are blocked. This prevents accidental sharing with unauthorized domains. Performance is minimal; the check happens at invitation time. Common issue: the partner uses multiple domains (e.g., 'partner.com' and 'partnerglobal.com'), so the admin must add all partner domains. If a domain is missed, sharing fails with a generic error, leading to help desk calls.

A marketing department needs to share press releases with journalists without requiring sign-in. The admin enables 'Anyone' links at tenant level but sets expiration to 7 days and requires a password for all anonymous links. The marketing team creates a library with default link type 'Anyone' and expiration 7 days. Journalists receive a link and a password via separate email. This works well but poses a risk: if the password is weak or shared, anyone can access the document. The admin mitigates by using sensitivity labels to apply encryption and watermarking. Misconfiguration: if the admin forgets to set expiration, links never expire, leading to potential data exposure. The admin must regularly audit anonymous links using the 'Access review' feature.

A company builds an extranet for customers to access project documents. They enable 'New and existing guests' at tenant level. They create a site collection with sharing set to 'New and existing guests' and default link type 'Specific people'. Customers are invited as guests and must sign in with their corporate credentials. To enhance security, the admin configures Azure AD Conditional Access to require MFA for all guest users. Performance is good, but guest account lifecycle management is challenging: when a customer contract ends, the admin must manually remove the guest account. They use Azure AD Entitlement Management to automate guest access expiration. Common failure: if the Conditional Access policy blocks guests from specific IP ranges, customers traveling may be locked out, requiring a help desk override.