0

My users are having massive problems inviting their external clients to SharePoint Online Sites. It's very difficult to tell the difference between MS's convoluted processes/systems vs things that are just plain bugs.

Can somebody please clear this question up for me?...

Let's say "our" organization has Office 365 on our domain: ourdomain.com

We've set up a SharePoint Site that we'd like to give external users access to. As it turns out they also happen to use Office 365 on their own company's domain: externaldomain.com

If we invite somebody@externaldomain.com to one of our SharePoint Sites...

a) Should they be able to login with their own Office 365 / domain account to access the site? (without creating a "Microsoft personal" account)

-or-

b) Do they need to create a "Microsoft personal" account.

As we probably all know, there's a massive number of bugs in the SharePoint login/invitation system, so I'm not even sure if what we're trying to do should work or not when trying to troubleshoot these issues for users.

We're having issues with users being rejected for "not being found in directory" and other issues, which I can troubleshoot myself, but it's very hard to even start when I don't even know the answer the question I'm asking here.

I would appreciate if this question does not get shut down based on one of the crazy pedantic rules of these sites, because it's a very clear technical question with a right/wrong answer that will help other people. Leaving it up and not allowing answers makes zero sense. I've scoured the web for hours to try and find a definitive answer to the question, but can't find one.

2

There's a whole raft of options that can affect how external users interact with SharePoint Online. But to keep this concise and answer your question:

Yes, external users (or partners) can be added to SharePoint Online using their own O365 (Work or School Accounts). However, at the moment, these users should be added to your AAD tenant as Guest Users through the Azure AD B2B feature.

It's worth noting the two differences between the account types: Microsoft Accounts (or MSA) and Work or School Accounts (typically used in Office 365/AAD).

Azure AD B2B will also work for external users that do not have AAD/O365 accounts.

The article Office 365 external sharing and Azure Active Directory B2B collaboration will better explain the difference between SPO/OD4B sharing and Azure AD B2B.

  • 1
    Thanks for the detailed & informative answer. Just to clarify, you mentioned that to add external O365 users, I should use Azure AD B2B. Should it work even if we don't do this? i.e. When a non-O365admin user simply clicks the "Share" button in the SharePoint site itself? – LaVache Apr 21 '17 at 9:15
  • That depends on if your customer wants to allow non-O365 admins to share with external partners in the first place ;). I think that SPO should still work to MSA and Work/School accounts,, but as the article provided states, MS are looking to converge the invite process so that SPO uses the B2B API's. The better governance option is to remove the ability to share with 'new' (only existing) external users in SPO and allow Admins to on-board external users through the AAD B2B process; but that is all dependent on your requirements – z.rahui Apr 23 '17 at 11:59
2

The access provision to external user works via invitation sent to his / her email and the external user can click on the invitation link to login for first time (after creating a MS account if not already associated with external user's email). Important thing here is the external user can click on the invitation link and use any email (with MS account) to gain access unless you set the following setting

SPO admin -> Sharing ->

External users must accept sharing invitations using the same account that the invitations were sent to

I always check this option and helps in governance.

This is important because the email used to login for the first time is what SharePoint will consider as the external user's user ID, regardless of what email the actual invitation was sent to. Also, invitation expires after first login. So, there is no way to change this unless a new invitation was issued.

Error message when an external user accepts a SharePoint Online invitation by using another account

Accessing SharePoint Online content as an external user

enter image description here

2

The access provision to external user works via invitation sent to his / her email and the external user can click on the invitation link to login for first >time (after creating a MS account if not already associated with external user's >email). Important thing here is the external user can click on the invitation >link and use any email (with MS account) to gain access unless you set the >following setting

SPO admin -> Sharing ->

External users must accept sharing invitations using the same account that the >invitations were sent to I always check this option and helps in governance.

I ran into an issue trying to use a personal Microsoft account (that has a gmail address as a login alias) to accept a SharePoint external sharing invitation.

I added the address (trying both the gmail alias or hotmail/outlook address) to the sharing invite via SharePoint Online. The invitation gets set. The user is presented the Invitation login screen to choose a Microsoft or Organizational account. When clicking Microsoft account and putting in the account name (either gmail or hotmail/outlook, same account the invite was sent with), the below error happens. I spent 3 days on the phone with Microsoft and they couldn't give me a reason for this, other than saying to remove the account alias. Finally, switching this setting to allow accepting invitations from other addresses, the Microsoft accounts with alias' now work.

I've found no documentation regarding personal Microsoft accounts and the use of a login alias and Microsoft only said the alias must be removed, or disable the sharing setting above.

SharePoint Online-External-Microsoft Account-Something went wrong

0

sharing a folder seems to work most of the time (share with gmail account or another tenant's onmicrosoft.com account), but users from some domains don't work. They open the link, and at the verify identity page they enter their email, but then they are redirected to ADFS login page, which does not recognise their account and so they can not login. What would cause this?? In SPO Admin > Sharing there is no restriction set for share domains. Also they are not on our network either. They come in through their own internet connection.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.