Administrator testing external SharePoint guest invitation

External sharing in SharePoint lets your team give people outside your company, such as clients, vendors and accountants, access to files, folders or whole sites. You control it in layers: an organization-wide limit in the SharePoint admin center, tighter settings on individual sites, and guest account rules in Microsoft Entra ID. Set all three layers deliberately and sharing becomes safe, trackable and easy. Leave them at guesswork and files leak by email or personal cloud accounts.

This guide walks through how the settings work, which level suits a small business, what trips people up, and how to move off a file server without losing control of who can see what.

Mavericks Office Solutions
Make SharePoint Sharing More Secure
Mavericks Office Solutions provides managed IT services and cybersecurity to help small businesses address technology security and operational challenges.

Explore IT solutions

TL;DR

  • The organization-level setting is the ceiling. Site and OneDrive settings can only match it or be stricter.
  • For most small businesses, “New and existing guests” is the safer choice over “Anyone” links, because every outside person ties back to a guest account you can audit.
  • Check Microsoft Entra ID guest settings too. A permissive SharePoint site does nothing if Entra blocks invitations.
  • Over-locking sharing backfires: people move to personal storage and email attachments, which is worse.
  • Moving from a file server to SharePoint is a good moment to redesign permissions, not copy old ones.

Table of Contents

How SharePoint external sharing is layered

Think of sharing as three gates, and a guest must pass all of them.

  1. The organization-level setting in the SharePoint admin center, under Policies, then Sharing. It applies to SharePoint and OneDrive.
  2. The site-level setting, which a SharePoint administrator can set per site.
  3. Microsoft Entra ID external collaboration settings, which govern whether guest accounts can be invited at all.

According to Microsoft’s sharing documentation, you can make individual sites or users’ OneDrive accounts more restrictive than the organization setting, but never more permissive. When two settings conflict, the more restrictive one wins. That is helpful: set a sensible ceiling once, then loosen nothing and tighten where needed, for example on a site holding payroll or legal files.

The four sharing levels, in plain terms

At the organization level, Microsoft lists four choices, from most to least open:

Level What it means in practice Typical fit
Anyone Links work for anyone who has them, with no sign-in Rare. Public marketing files, with expiration set
New and existing guests Outsiders must sign in or verify with a code, and become guests in your directory Most small businesses working with clients and vendors
Existing guests You share only with guests already in your directory Tighter control, with an admin approving new guests
Only people in your organization External sharing is off Highly regulated or internal-only environments

The Anyone option can be narrowed. Per Microsoft, you can require Anyone links to expire within a set number of days or to grant only View permission. If you do allow them, use both restrictions.

An Anyone link is a key left under the mat. Whoever forwards it, forwards access. Microsoft’s own Entra guidance for Teams, SharePoint and OneDrive points toward guest-based sharing for governed collaboration, since access is then tied to a managed account. That is also what lets you answer the question owners eventually ask after an incident: who opened this file, and when?

Guest access: what actually happens when you invite someone

External sharing in SharePoint and OneDrive uses Microsoft Entra B2B collaboration to create guest accounts for outside people, as Microsoft’s collaboration planning page explains. Guests can get access to a whole site or to a single file or folder.

A few practical points:

  • Invite to the narrowest scope. Share a folder instead of a site when the partner needs one project.
  • Prefer named people over links. A “specific people” link is tied to an identity. A forwardable link is not.
  • Re-share old documents. As of June 2024, invitations sent through the legacy SharePoint Invitation Manager no longer grant access. If a long-ago share suddenly fails, the file must be reshared to create a valid invitation.
  • Review guests regularly. Contractors finish projects. Their access should not outlive them.

Check Microsoft Entra ID, not just SharePoint

This is the most common gap we see described by practitioners. Sharing in Microsoft 365 is partly governed by the External Identities and external collaboration settings in Entra ID, per Microsoft’s secure access guidance. If a site allows external sharing but the Entra setting blocks invitations, your staff click Share, hit an error, and conclude the system is broken.

SharePoint and Entra guest invitation controls

Microsoft’s guide to a more secure guest sharing environment notes that some options require guests to exist as accounts in Entra ID, and recommends enabling the SharePoint and OneDrive integration with Entra B2B so guests land in the directory. Verify both layers after any change by sending a real test invitation to an outside address.

Limit who you share with: allowed and blocked domains

If you work with a known set of partners, restrict sharing by domain. Administrators can create an allow list or a block list, listing up to 5,000 domains through the admin center or PowerShell. Two cautions:

  • The restriction applies across all SharePoint and OneDrive sites in the organization.
  • It can also affect Entra B2B collaboration when the two are integrated, so test before rolling out.

An allow list suits a firm that shares only with a handful of clients, a bank and an accountant. A block list suits a company with a clear set of domains it never wants to receive files.

Protect sensitive files whatever the site setting says

Sharing settings are blunt. They say who can be invited, not what is inside the file. Microsoft Purview Data Loss Prevention and sensitivity labels add the second layer. Per Microsoft’s file collaboration guidance, you can block external sharing of documents containing sensitive information such as personally identifiable information, and use labels on sites and teams to enforce privacy and external access rules without constant manual oversight.

For a deeper look at how DLP policies and sensitivity labels govern sharing for sites and teams, that page is worth your time. For a plain-English checklist aimed at small firms, see our own guide to data loss prevention for SMBs.

Also require MFA for every guest and employee. Our Microsoft 365 MFA setup guide takes about ten minutes to follow, and it closes the door most attackers try first.

Protect sensitive files whatever the site setting says — overview diagram

Do not over-lock it

The goal is not to forbid sharing. Microsoft’s secure collaboration guidance frames it as moving from ad-hoc sharing like email attachments to governed, auditable collaboration. When the approved path is painful, people take the unapproved one: personal email, personal cloud storage, a USB stick. Then you have no logs and no way to revoke anything.

A workable pattern for a small business:

  • Set the organization level to New and existing guests.
  • Turn off or tightly limit Anyone links.
  • Create separate sites for client-facing work, with guest sharing on, and keep internal sites on stricter settings.
  • Label sensitive sites so the stricter rules are automatic.
  • Review guests quarterly.

Guest expiration: set it, but warn people

Guest expiration keeps your directory tidy, but it has a sting. If site owners forget to renew, a legitimate client loses access in the middle of a project. Microsoft’s collaboration planning documentation covers expiration options. Pair any expiration with reminders to site owners well ahead of the deadline, and tell owners who is responsible for renewing.

OneDrive external sharing

OneDrive follows the same model. Its sharing setting can be equal to or stricter than SharePoint’s, never looser. That surprises owners who loosen OneDrive and see nothing change: fix the organization-level setting first. Individuals sharing from OneDrive should use named-person links, and anything a team works on together belongs in a SharePoint site or Teams channel, not a personal drive that disappears when an employee leaves.

Moving from a file server to SharePoint

Many readers asking about sharing are also asking whether to replace a file server. The honest answer: for most small offices, SharePoint fits well because outside collaboration, remote access and version history come built in. A file server needs a VPN and gives you no clean way to share a folder with a client.

Microsoft provides Migration Manager in the SharePoint admin center for moving file shares. You install a lightweight agent on a computer or virtual machine, create tasks pointing at the network share, and migrate. The source server must support SMB 2.0 or higher.

The tool moves files. It does not design your structure. A sound approach:

  1. Inventory the shares. Find what is stale and archive or delete it before moving.
  2. Map folders to sites. One site per department or client group, rather than one giant library.
  3. Rebuild permissions on purpose. Use groups, not individual grants, and do not copy decades of accumulated exceptions.
  4. Decide sharing per site before migration, so a finance site never inherits client-facing rules.
  5. Pilot with one team, then migrate the rest.
  6. Back up the result. Cloud storage is not a backup by itself. See our note on Microsoft 365 backup for Ohio SMBs.

Our perspective

We run IT as an outsourced department for small and mid-sized businesses in Ohio and Michigan, and sharing questions land on our help desk constantly. Our view is simple: the settings are not the hard part. The hard part is deciding who owns each site, who approves guests, and who reviews access six months later.

We would rather see a client with a sensible “New and existing guests” policy, MFA on every account and a named owner per site than a perfectly locked tenant that staff route around. Security that people avoid is not security. Our local, USA-based help desk exists partly for this reason: when someone cannot share a file with a customer at 4 p.m., a quick answer from a person keeps them off the workaround.

If you take one thing from this article, take this: configure the native Microsoft 365 tools properly, give people an easy approved path, and review it on a calendar.

— Jeffrey

Want someone to set this up for you?

If you would rather not untangle SharePoint, Entra and DLP settings yourself, our team handles it as part of managed IT services and Microsoft 365 support. We can review your current sharing configuration, tighten it without breaking client workflows, and plan a file server migration. If you are comparing providers, our scorecard for choosing a managed IT provider lists eight criteria to use. Security questions go to our cybersecurity team.

A quick audit you can do this week

  • Open the SharePoint admin center, go to Policies, then Sharing, and write down the current organization setting.
  • Check whether Anyone links are allowed and whether they expire.
  • List your sites with external sharing on. Does each one need it?
  • Send a test invitation to an outside address to confirm Entra lets it through.
  • Review current guests and remove anyone with no active project.
  • Confirm MFA is required for everyone.

FAQ

What is the difference between SharePoint external sharing and guest access?

External sharing is the policy that decides whether and how people outside your company can receive access. Guest access is the result: an outside person gets a guest account in your Microsoft Entra directory and signs in to reach the content. Anyone links are the exception, since they need no sign-in.

Can a site be more open than the organization setting?

No. The organization-level setting is the maximum. Individual sites and OneDrive accounts can be set equal or stricter, and where settings conflict the more restrictive one applies. To open one site further, you must first loosen the organization setting, which is why we suggest a deliberate ceiling.

Why can my staff not invite guests even though the site allows it?

Check Microsoft Entra ID external collaboration settings. If they block guest invitations, SharePoint’s setting cannot override them. Testing both layers with a real invitation usually finds the cause within minutes.

Is SharePoint better than a file server for a small business?

For most offices with remote staff or outside collaborators, yes, because sharing, version history and access from anywhere are built in. A file server can still make sense for specific on-site software or very large local files. Plan permissions before you migrate either way.

Sources