Describe Microsoft 365 apps and services →mediumMultiple Choice

MS-900 Describe Microsoft 365 apps and services Practice Question

You need to provide external partners access to a single document without giving them access to your entire SharePoint site. What should you do?

⚠ Common exam trap

A common mix-up: candidates confuse 'guest access' (which grants site-level access) with 'document-level sharing' (which is granular), leading them to incorrectly choose Option A, assuming guest access can be scoped to a single document.

Answer choices

Why each option matters

Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.

Correct answer & explanation

✓

Share a direct link to the document with specific permissions

Sharing a direct link with specific permissions allows you to grant external partners access to a single document without giving them broader access to the entire SharePoint site. This method uses SharePoint's granular permission model, where you can set the link to 'Specific people' and restrict permissions to 'View' or 'Edit' only on that document, ensuring no unintended access to other site content.

Answer analysis

Option-by-option breakdown

For each option: why learners choose it and why it is or isn't the right answer here.

✗
Add the partners as guests to the SharePoint site
Why it's wrong here
Adding the partners as guests to the SharePoint site grants them membership to the entire site, including every document, list, and page within that site, not just the single document you intend to share. This violates the principle of least privilege, exposes far more content than necessary, and complicates access review. Site-level guest access is a broader identity and permission model that requires careful site-level security configuration and is inappropriate for a one-off document share.
✗
Email the document as an attachment
Why it's wrong here
Emailing the document as an attachment sends an uncontrolled copy that recipients can forward, save, or edit outside Microsoft 365, removing all centralized auditing, retention, and revocation capabilities. The original remains under your control, but every copy becomes an unmanaged data artifact, potentially violating compliance policies like data loss prevention (DLP). You also lose the ability to set an expiration date or require authentication, and large files may be blocked by email size limits.
✗
Create a Microsoft 365 group and add them
Why it's wrong here
Creating a Microsoft 365 group and adding the partners grants them access to a full collaboration container that includes a shared mailbox, calendar, OneNote notebook, team site, and all documents in that group's document library. Adding members to a group assigns them to a security principal with resource-level permissions across all group-connected services, which is far broader than the single document. This approach misuses group membership as a document-sharing mechanism and creates an under-governed subset of your directory with potential licensing and compliance implications.
✓
Share a direct link to the document with specific permissions
Why this is correct
Sharing a direct link to the document with specific permissions (for example, 'Specific people' or 'Anyone with the link' with view or edit rights) scopes access to exactly that file, while allowing you to set an expiration date, require sign-in, or disable downloading. This uses SharePoint's granular sharing engine, which stores the link in the file's access control list, gives you the ability to revoke access at any time, and generates audit events in Microsoft Purview. It is the recommended method for granting external partners limited, document-specific access because it balances collaboration with security and least privilege.

Go deeper

MS-900 Describe Microsoft 365 apps and services Practice Question

Why each option matters

Option-by-option breakdown

Related to this question