External sharing in SharePoint: Inviting guests without leaving the door wide open

External sharing in SharePoint and OneDrive lets you share content specifically with people outside your own company, such as partners, customers, or service providers, and is enabled by default for the entire environment in a Microsoft 365 tenant. Anyone who doesn't want to accidentally leave the door wide open must therefore actively set this at the organization and site level instead of relying on the default. As of: August 2026.

How do tenant and site settings relate to each other?

The setting at the organization level forms the upper limit for all sites; an individual site can further restrict external sharing, but cannot loosen it beyond the organization-wide setting. If the site and organization settings differ, Microsoft says the more restrictive value always applies, and OneDrive settings may be identical to or more restrictive than the SharePoint settings, but not more open. At the organization level, according to the Guide to managing sharing settings four levels are available: "Anyone" via an unauthenticated link, "New and existing guests" with sign-in or a verification code, "Existing guests" only for people already in the directory, and "Only people in your organization," which disables external sharing entirely. If you restrict or disable sharing, guests typically lose access within an hour, according to Microsoft.

What happens technically when I invite a guest?

According to the Overview of external sharing from Microsoft, SharePoint has two sharing models: external SharePoint authentication without a guest account, where no Microsoft Entra settings apply, and integration with Microsoft Entra B2B, where a guest account is always created and the Entra settings for guest invitations apply. When sharing a file or a folder, an invitation is sent by email with a link to the shared item. Important in practice: since June 2024, invitations sent via the older SharePoint invitation manager no longer grant access; affected documents must be shared again.

What can guests actually do?

Guests are limited to basic tasks as long as they don't have their own license in your tenant: they can view and edit documents via Office.com, but cannot install the desktop version of Office without an assigned license. Which actions they may perform on a site depends on the assigned permission level, such as viewing, adding, editing, or deleting lists and files as a site member. As soon as a guest needs larger features such as OneDrive storage or creating their own Power Automate flow, an assigned license is required for that.

How do I protect sensitive content anyway?

The most reliable way to protect confidential information is to store it on its own site where external sharing is disabled, rather than letting it run alongside a generally shared site. For internal sharing, you can also prevent site members from resharing content themselves and enable access requests instead. A detail that's easily overlooked: if you share a folder with several guests, those guests can see each other's names in the "Manage access" area.

How do I end a share again?

To end a specific guest's access, remove their permission on the shared item or remove the guest directly from the directory. For shares via a general "Anyone" link, delete that link on the respective item or disable Anyone links entirely at the site level. If you want to do this cleanup regularly rather than only as needed, part of it can be scheduled as part of our Automation services, for example as a recurring check of expired guest accounts.

Frequently asked questions about external sharing in SharePoint

Is external sharing enabled by default in SharePoint?

Yes, according to Microsoft, external sharing is enabled by default for the entire SharePoint and OneDrive environment. Anyone who doesn't want this must deliberately restrict it at the organization or site level before users start working with the site.

Does every guest need a Microsoft 365 license?

No, for basic collaboration such as viewing and editing documents via Office.com, the guest account without its own license is enough. Only for more advanced features such as OneDrive storage, the desktop version of Office, or creating their own Power Automate flows does the guest need an assigned license.

What's the difference between SharePoint authentication and Microsoft Entra B2B?

With external SharePoint authentication, no guest account is created and Microsoft Entra settings don't apply, while with Entra B2B integration enabled, a guest account is always created and the Entra settings for external collaboration apply. Which model is used depends on whether Microsoft Entra B2B integration is enabled for the tenant.

Why can multiple guests in a shared folder see each other?

Because in the "Manage access" area, SharePoint shows everyone who has access to an item, including other guests. This is a point worth considering in advance for sensitive shares to multiple external parties, for example by using separate shares instead of a joint one.