I'm using SharePoint 2013 On Premise for a team site. Supposedly, external users will need to access to this site. However, I could not figure out how to share the site with external users. All I can find is for Office 365.

My question is:

Is Sharing with external users allowed in SharePoint 2013 On Premise?

4 Answers 4


It is possible to use SharePoint 2013 with external authentication services such as Windows Live-ID, Google and Facebook. But there is a catch (as always). You need to connect your On-Prem SharePoint 2013 environment to Windows Azure Active Directory Access Control Service (Azure AD Access Control).

enter image description here

Even though the Azure AD Access Control is free to use (at the moment), you still need an Azure AD Premium subscription which costs little over €5 per user a month. But Access Control users (Live-ID, Google, Facebook …) doesn’t require a user license.

enter image description here

But if you want to use multi-factor authentication your external users have to be real Azure AD users. The benefit of using multi-factor authentication is (of course) the increased security. Just using username and password as authentication is too unsecure in a business application. It works in your own football-team or the local bridge club, but for sensitive data it simply isn’t enough.

For this reason, Microsoft have implemented Multi-Factor Authentication. For the user this means that a regular Live-ID or Google-account can’t be used unless it uses 2-factor authentication. Fortunately both Live-ID and Google have support for 2-factor authentication through SMS-service, Google Authenticator App and others.

enter image description here



I believe the last response is correct, except that you should use Forms Based Authentication to avoid any licensing requirements. If you stick to claims based authentication and create an AD account for the external user you would not require a SharePoint CAL but you would require a Windows Server CAL.


Yes, SharePoint 2013 On-Premises allows for sharing content in a team site with external users.

From a licensing perspective, you do not need client access licenses (CALs) for external users in your scenario since external users are covered by the SharePoint Server license. But, you would need a CAL for each internal user. And, if you have SharePoint 2013 Enterprise, you would also need an Enterprise CAL for each internal user as well.

From a "how to" perspective, assuming you are using Active Directory (AD) to authenticate all users, your external users need to be given AD accounts and then you need to set up the permissions for the external users accounts on your team site. The same concept applies if you are using a different form of authentication.


I've managed to configure federation by following this guide Then I've added alternate access mapping by using different port

I was using the second configuration in Configure the SharePoint web application section:

# This script extends an existing web application to set Azure AD authentication on a new zone
# URL of the default zone of the web application
$webAppDefaultZoneUrl = "https://portal.mycompany.local"
# URL of the SharePoint site federated with ADFS
$trustedSharePointSiteUrl = "https://portal.mycompany.local/"
$sptrust = Get-SPTrustedIdentityTokenIssuer "AzureADTrust"
$ap = New-SPAuthenticationProvider -TrustedIdentityTokenIssuer $sptrust
$wa = Get-SPWebApplication $webAppDefaultZoneUrl

New-SPWebApplicationExtension -Name "SharePoint - Mycompany Azure AD" -Identity $wa -SecureSocketsLayer -Zone Custom -Url $trustedSharePointSiteUrl -AuthenticationProvider $ap

Also, I've chosen my certificate, which I was configuring using Let's Encrypt and certbot.

After everything was done, I was able to add external user from different company and was able to authenticate using it to my sharepoint 2013 on-premises site

enter image description here enter image description here

Not the answer you're looking for? Browse other questions tagged or ask your own question.