Sharing SharePoint site between Office 365 tenants

Question

We have multiple companies with different Office 365 tenants. We need to create a SharePoint site where all our users across our Office 365 tenants have access to one SharePoint site. We would like like news in each tenants to automatically have access to the SharePoint site. Anonymous users cannot access the site.

How do I setup a SharePoint Online site where all multiple tenants Office 365 tenants can access the site?

How do I grant permissions to all users (including future new users) that exist in the external tenant automatically?

Answer 1

This sounds like the Business to Business (B2B) scenario. One of your SharePoint tenants will need to create an Extranet site and invite the other tenants to that site. You can use this article to plan the B2B rollout.

Creating an extranet site is pretty straightforward.

1. Create a new team site using the SharePoint Online admin center
2. Select the check box for the site collection that you created, and click Sharing
3. Under Sharing outside your company, choose Allow external users who accept sharing invitations and sign in as authenticated users
4. Under Allowing non-owners to invite new users, click Turn off sharing for non-owners on all sites in this site collection

From here, the rest is inviting your external users to the site using the same share actions as you would with any other user. You also have the ability to monitor who is coming into the site collection and add or remove people as necessary.

As an additional safety valve, you can restrict external sharing to specific domains. Restricting domains helps keep you content safe within your organization without disallowing external sharing. Domain restriction can be done at either the tenant or site collection level.

Tenant level domain restriction

1. Go to the SharePoint Admin Center
2. Select the sharing tab
3. Under Additional settings, select the Limit external sharing using domains check box
4. From the drop-down list, choose either:
   • Don’t allow sharing with users from these blocked domains to deny access to targeted domains
   • Allow sharing only with users from these domains to limit access to only to the domains you list
5. List the domains in the box provided, using the format domain.com. If listing more than one domain, separate each domain with a space or a carriage return.

Quick notes:

You can also configure the tenant-level setting by using the Set-SPOTenantWindows PowerShell cmdlet.

You can also use restricted domains at the site collection level. Note the following considerations:

In the case of conflicts, the tenant-level configuration takes precedence over the site collection configuration.

If a tenant-level allow list is configured, then you can only configure an allow list at the site collection level. The site collection allow list must be a subset of the tenant allow list.

If a tenant-level deny list is configured, then you can configure either an allow list or a deny list at the site collection level.

For individual site collections, you can set the sharing restrictions by selecting the site in the admin center and select the sharing button from the ribbon. Check Limit external sharing using domain and follow the same steps as above for listing out the restricted domains.

To bulk add users, you can fetch their display name and object id from the external AAD instance. After fetching that data, you can import those users into your AAD instance. The security group they are added to can be secured for the specific extranet sites.

Note that for advance functionality, these external users may need to have SharePoint licenses added to them as there is a limit to what guest account are permitted to do.