SharePoint online extranet

Question

We are looking to implement an extranet for our clients and considering sharepoint as an option. I am new to sharepoint. We are using sharepoint online, but could switch to a hosted setup if needed.

It looks like I need to implement one "parent" site collection for the common stuff like a common login page. For each client, we need to create a site collection which references the resources that client has access to by group permissions.

My questions are: 1. How to implement the login page? Any suggestions to override the default microsoft login page? 2. When the user logs in, how to forward the user to the client site that they have access to?

Thanks in advance,

Steve

Answer 1

SharePoint Online is not appropriate for this type of setup. I would instead look at hosting it yourself, or find a service that will allow you to host VMs which you maintain. You cannot implement your 'own' login page for non-licensed accounts. The alternative is licensing every customer and using ADFS or another federation service that leverages on-prem Active Directory accounts.

As for the forward, you could probably use some JavaScript trickery on an ADFS login page... but not quite sure on that one.

Again, SPO doesn't sound appropriate for what you're after.

Answer 2

Its very much possible with SharePoint Online and ADFS with single sign-on integrations. for more details you can refer to the below technet articles from Microsoft.

https://technet.microsoft.com/en-us/windows-server-docs/identity/ad-fs/operations/ad-fs-user-sign-in-customization

https://blogs.technet.microsoft.com/canitpro/2015/09/11/step-by-step-setting-up-ad-fs-and-enabling-single-sign-on-to-office-365/

Where as in SharePoint on-premise environment, it's kind of simple where you will be extending the web application to extranet zone and configure the forms based authentication with your own authentication provider (such as SQL,LDAP and so on). Also designing and maintaining the login is all in your control since it will be part of the SharePoint environment which is not the case with SharePoint online as it is generally with infra teams (i.e, ADFS Servers).

Additional advantage with SharePoint On-premise solution is you can have your own DNS names for the site collections specific to each client requirement where as in SharePoint Online, you can only have the only names DNS name which is companyname.sharepoint.com/sites/sitecollectionname

Answer 3

SharePoint Online could work, but it wouldn't run like a "normal extranet". In SharePoint Online, you would simply share site access with the external user email addresses, and they are then required to use/back/link their company email address with Office 365 account or consumer Microsoft account. The beauty of this is you aren't in the business of credentialing users who aren't in your organization.

If you didn't want to do that, you could license them yourself as cloud only users or synced up from your local AD with Azure AD Connect. This will cost you on a per user per month basis.

When sites are shared with external users, they get an email with the site address in the format kesava pointed out, tenant.sharepoint.com/teams(sites)/sitecollection. You can also create search results pages that show site collections or webs, and would show the user what they have access to.

Answer 4

To build off the above answers.

You have the ability to onboard your clients in bulk and that's exactly what Microsoft create the Azure AD B2B (Busines to Business) API for. You can upload a list of addresses and those users will get an email inviting them to your tenant. This is a little different from the external sharing in OneDrive/SharePoint, but essentially works the same. Once they have validated their accounts you can assign them permission like you would an internal user.

One of the benefits of using Azure AD to onboard external users over the native Sharing in SharePoint is that that sign-up experience is better. In the Background, if users don't have an azure AD instance for a domain, Microsoft create one transparently and creates their account there. It works a bit better than going thru the process of creating a Microsoft account. Additionally, new rollouts allow you to set MFA requirements and enforce them even if the clients themselves don't require that in their Azure Tenants (which they won't if they are created on the fly).

The downside is I believe B2B is still considered preview, so thing may change on you.

After you figure out the Auth, the other piece that may make sense in your scenario may be using Office 365 Groups. You can have one for each client and you can still leverage a central SharePoint site and Pin that to your groups as you create them.

I don't know about forwarding - but you could consider creating custom app tiles for each customer to their Office 365 groups page, and assigning those to only the users that need the specific tiles. That way those specific sites appear as tiles in the app launcher but only for the users assigned them.

Answer 5

Full disclosure, I work for a software company that sells software for using SharePoint as an extranet, but that means that I work with SharePoint extranets on a daily basis and can probably answer any questions you have.

First, let me answer your stated questions. How to implement the login page? Any suggestions to override the default microsoft login page? - If you are using a hosted solution, this is relatively simple. When creating the web app there is a section for sign in page. Default is checked but you can choose the radio button for custom and then just enter the path to the custom sign in page.

When the user logs in, how to forward the user to the client site that they have access to? - the way we handle this is to assign the user a "Home Site" and once they log in the redirect looks for this home site URL and takes them there. Another way you may do it would be to allow everyone access to a root site collection and then have a security trimmed list of all the sites the logged in user has access to so they can choose the correct site collection. Which leads me to your other comment. Yes, I would use a root site collection with general information and then separate site collections (and even Host Named Site Collections depending on your needs) for each client.

Another important question you need to consider is "who is going to own the user management?" Will the end user be responsible for adding/inviting users? What type of permissions will that end user need? Are you going to make them site owners/sc admins? Most people would not want to give their end users that much permissions but are not sure how else to regulate it. This gets very tricky with SharePoint Online. You have to be very careful setting it up or you could inadvertently allow people outside your organization to start sharing documents without your knowledge and turn into a compliance nightmare.

My suggestion would be to get SP2013 foundation and configure a web application for forms based authentication. Should you have additional questions or like some blog posts on best practices, please feel free to reach out to me. I know it can be a big task but we can help you through it!