SharePoint Online external sharing is controlled in layers: Microsoft Entra external collaboration settings decide who may invite guests and from which domains, the organization-level sharing level in the SharePoint admin center sets the most permissive option any site can use, and each site or OneDrive can then be set to the same level or tighter. To configure it, set the Entra invite settings first, choose the organization level for SharePoint and OneDrive under Policies > Sharing, add domain limits, Anyone link expiry and guest access expiration, then tighten individual sites in Active sites or with Set-SPOSite. Since mid-2026, all new external sharing in commercial tenants goes through Entra B2B, which changes how guests sign in and how domain lists interact.
Who this is for and what you will have
This guide is for Microsoft 365 and SharePoint administrators setting up or tightening guest collaboration. At the end you will have:
- Entra invite and domain settings that match your SharePoint plans.
- Organization sharing levels for SharePoint and OneDrive, with consistent domain lists.
- Expiring, view-only Anyone links if you allow them, and automatic guest access expiry.
- Verified site-level overrides for sensitive and partner-facing sites.
How the layers fit together
| Layer | What it controls | Where |
|---|---|---|
| Entra external collaboration settings | Who can invite guests, what guests can see in the directory, allowed or blocked domains for invitations | Entra admin center > Entra ID > External Identities > External collaboration settings |
| Microsoft 365 Groups guest settings | Whether group owners can add guests and whether guests can access group resources | Microsoft 365 admin center |
| SharePoint organization settings | Sharing level for SharePoint and OneDrive, domain lists, who can share, link defaults, Anyone link rules, guest expiration | SharePoint admin center > Policies > Sharing, or Set-SPOTenant |
| Site settings | Sharing level, domain list, default links and guest expiration for one site | SharePoint admin center > Active sites, or Set-SPOSite |
| OneDrive per user | Sharing level for one user's OneDrive | Microsoft 365 admin center > user > OneDrive tab, or Set-SPOSite |
The most restrictive applicable setting wins, including when an Entra setting is stricter than SharePoint. Site owners can't change site-level external sharing settings; that needs at least the SharePoint Administrator role.
What changed in 2026
Two changes affect every commercial tenant:
- Entra B2B integration is always on. Between May and July 2026, Microsoft enabled SharePoint and OneDrive integration with Entra B2B for new external sharing in commercial tenants.
EnableAzureADB2BIntegrationno longer controls sharing behavior there, and the integration can't be disabled. Invited external people get a guest account in your directory and are subject to Entra policies such as multifactor authentication and to the Entra invite and domain settings. - SharePoint one-time passcode authentication is retiring. Starting in October 2026, SharePoint OTP is retired for commercial tenants; Entra B2B email one-time passcode stays supported. External users who reach previously shared Specific people links without a matching Entra guest account get access denied. Creating a guest account for the email address used in the original share, or sharing at least one file, folder or site with that person, restores access to everything previously shared with them.
Prerequisites
- SharePoint Administrator role for the SharePoint admin center and SharePoint Online Management Shell steps.
- A role that can update external collaboration settings in Entra, such as External Identity Provider Administrator. Microsoft's allow and block list procedure uses Global Administrator; use the least privileged role that works.
- The SharePoint Online Management Shell:
Connect-SPOService -Url https://contoso-admin.sharepoint.com- A list of partner domains, the sites that must never be shared externally, and an agreed guest access lifetime.
- A test account outside your organization for verification.
Step 1: Set Entra invite and domain rules
In the Microsoft Entra admin center, go to Entra ID > External Identities > External collaboration settings.
Under Guest invite settings, choose who can invite:
| Option | Effect |
|---|---|
| Anyone in the organization can invite guest users including guests and non-admins | Most inclusive |
| Member users and users assigned to specific admin roles can invite guest users including guests with member permissions | Members can invite; guests can't unless they have member permissions |
| Only users assigned to specific admin roles can invite guest users | Only User Administrator or Guest Inviter role holders |
| No one in the organization can invite guest users including admins | Most restrictive |
This matters for SharePoint: Entra settings decide who can invite guests for site sharing, and with B2B integration they also apply to file and folder sharing. If you later restrict external sharing in SharePoint to specific security groups, those users must also be allowed to invite in Entra.
Under Guest user access, the default limits what guests can see in the directory; the most restrictive option limits guests to their own profile.
Under Collaboration restrictions, choose an allow list or a block list:
- You can have one or the other, not both, and switching discards the existing list.
- The whole policy is limited to 25 KB (25,000 characters), which is about 1,600 domains if entries average 15 characters.
- The list doesn't affect guests who already redeemed an invitation; a pending invitation to a newly blocked domain fails at redemption.
Cross-tenant access settings are also checked when an invitation is sent. To require MFA or other conditions for guests, use Conditional Access; the zero trust remote access architecture includes a guest-specific Conditional Access signal.
Step 2: Choose the organization sharing level
In the SharePoint admin center, expand Policies and select Sharing. Under External sharing, set separate levels for SharePoint and OneDrive. OneDrive can be more restrictive than SharePoint, never more permissive.
| Admin center level | SharingCapability value | What users can do |
|---|---|---|
| Anyone | ExternalUserAndGuestSharing | Share files and folders with links that need no sign-in; share sites with guests who authenticate |
| New and existing guests | ExternalUserSharingOnly | Share with people outside the organization who sign in or verify with a code; they are added to the directory |
| Existing guests | ExistingExternalUserSharingOnly | Share only with guests already in the directory |
| Only people in your organization | Disabled | No external sharing |
Choose the most permissive level any site genuinely needs. The PowerShell equivalent:
Set-SPOTenant -SharingCapability ExternalUserSharingOnly -OneDriveSharingCapability ExistingExternalUserSharingOnlyIf you restrict or turn off external sharing, guests typically lose access within one hour. If you turn external sharing off for the organization and later turn it back on, guests regain access and shared links resume working, so turn sharing off on specific sites first if you want those guests gone for good.
Step 3: Limit sharing by domain
On the same Sharing page, expand More external sharing settings, select Limit external sharing by domain, then Add domains. Choose Allow only specific domains or Block specific domains and enter up to 5,000 domains, one per line, in the format fabrikam.com. Wildcards aren't supported.
# Organization: only allow two partner domains
Set-SPOTenant -SharingDomainRestrictionMode AllowList -SharingAllowedDomainList "fabrikam.com litware.com"
# Or block specific domains instead
Set-SPOTenant -SharingDomainRestrictionMode BlockList -SharingBlockedDomainList "adatum.com"PowerShell takes a single space-separated string. Rules for combining the organization and site lists:
- The organization configuration takes precedence where they conflict.
- With an organization allow list, a site allow list must be a subset of it, and sites can't use a block list.
- With an organization block list, a site can use either an allow list or a block list.
- A site list holds up to 500 domains.
- OneDrive accounts and group-connected sites that don't appear in the admin center list need
Set-SPOSitefor site-level domain limits.
Entra's collaboration restrictions also apply to SharePoint invitations, so keep both lists aligned.
Step 4: Control who can share and whether guests can reshare
Still under More external sharing settings:
- Allow only users in specific security groups to share externally, then Manage security groups. Add up to 12 security groups and set Can share with to Authenticated guests only (the default) or Anyone for each. Only members of those groups can share externally.
- Allow guests to share items they don't own should normally stay off. By default, guests need Full Control to share items externally. In PowerShell,
-PreventExternalUsersFromResharing $trueprevents external users from resharing files, folders and sites they don't own.
Set-SPOTenant -PreventExternalUsersFromResharing $trueStep 5: Set link defaults and Anyone link expiry
Under File and folder links, choose the default link type users see. Specific people is the most restrictive. Anyone with the link is only offered when the external sharing level is Anyone; if a site only allows authenticated guests, the default falls back to Only people in your organization.
If you allow Anyone links, use the advanced settings to require them to expire within a set number of days and to restrict them to view permission. When you shorten the expiration, existing links are updated to the shorter limit; when you lengthen it, existing links keep their current expiration.
Set-SPOTenant -RequireAnonymousLinksExpireInDays 30 -FileAnonymousLinkType View -FolderAnonymousLinkType View
Set-SPOTenant -CoreDefaultShareLinkScope SpecificPeople -CoreDefaultShareLinkRole View
Set-SPOTenant -OneDriveDefaultShareLinkScope SpecificPeopleRequireAnonymousLinksExpireInDays accepts 0 to 730, where 0 removes the requirement. CoreDefaultShareLinkScope and CoreDefaultShareLinkRole set the defaults for SharePoint sites and replace the older DefaultSharingLinkType and DefaultLinkPermission parameters; OneDriveDefaultShareLinkScope does the same for OneDrive.
Step 6: Expire guest access automatically
Select Guest access to a site or OneDrive will expire automatically after this many days and enter the number of days. In PowerShell:
Set-SPOTenant -ExternalUserExpirationRequired $true -ExternalUserExpireInDays 90The value can be 30 to 730 days. How it behaves:
- Expiration is set on guests as they join a site. Guests who had permissions before you turned the policy on aren't affected.
- When the date passes, the guest is removed from the site. Sharing links don't deactivate, but the guest can't get in. The Entra guest account isn't changed.
- Site owners see a banner two to three weeks ahead, and site collection administrators get a weekly email of upcoming expirations.
- Owners extend access under Settings > Site permissions > Guest Expiration > Manage, then Extend.
- Turning the policy off later stops new expiration dates being set but doesn't automatically clear existing ones; a site collection administrator can clear them.
Verification code reauthentication
The setting People who use a verification code must reauthenticate after this many days (EmailAttestationRequired and EmailAttestationReAuthDays, 1 to 365 days) applies to recipients using SharePoint verification codes. When Entra B2B integration is in use, the Entra email one-time passcode setting applies instead, so with B2B now always on in commercial tenants, manage this in Entra.
Step 7: Tighten individual sites and OneDrive accounts
New sites don't all start in the same place:
| Site type | Default sharing setting |
|---|---|
| Communication | Only people in your organization |
| Modern team site without a group | Only people in your organization |
| Classic | Only people in your organization |
| Group-connected, including Teams | New and existing guests if group owners can add people outside the organization, otherwise Existing guests only |
| OneDrive | Anyone |
The root communication site (contoso.sharepoint.com) defaults to Anyone; check it in every tenant.
To change a site in the admin center, go to Active sites, select the site (for a channel site, select the link in the Channel sites column first), and on the Settings tab select More sharing settings. Choose the sharing level, expand Advanced settings for external sharing to limit by domain, and clear Same as organization-level setting to set the site's own guest expiration, default link type or link permission. Select Save.
The same for a partner extranet site in PowerShell:
$site = "https://contoso.sharepoint.com/sites/fabrikam-project"
Set-SPOSite -Identity $site -SharingCapability ExternalUserSharingOnly
Set-SPOSite -Identity $site -SharingDomainRestrictionMode AllowList -SharingAllowedDomainList "fabrikam.com"
Set-SPOSite -Identity $site -OverrideTenantExternalUserExpirationPolicy $true -ExternalUserExpirationInDays 60
Set-SPOSite -Identity $site -DefaultShareLinkScope SpecificPeople -DefaultShareLinkRole ViewFor a site that allows Anyone links with a shorter lifetime than the organization, use -OverrideTenantAnonymousLinkExpirationPolicy $true -AnonymousLinkExpirationInDays 7. The override can be more or less restrictive than the organization value.
For a single user's OneDrive, go to the Microsoft 365 admin center, Users > Active users, select the user, open the OneDrive tab and select Manage external sharing, or run Set-SPOSite with -SharingCapability against the OneDrive URL.
Verify the configuration
Get-SPOTenant | Select-Object SharingCapability, OneDriveSharingCapability,
SharingDomainRestrictionMode, SharingAllowedDomainList, SharingBlockedDomainList,
RequireAnonymousLinksExpireInDays, ExternalUserExpirationRequired, ExternalUserExpireInDays,
PreventExternalUsersFromResharing
Get-SPOSite -Identity https://contoso.sharepoint.com/sites/fabrikam-project |
Select-Object Url, SharingCapability, SharingDomainRestrictionMode, SharingAllowedDomainList,
ExternalUserExpirationInDays, OverrideTenantExternalUserExpirationPolicyRead sites by -Identity. When Get-SPOSite is run with -Limit or -Filter, sharing properties such as SharingCapability, SharingAllowedDomainList and ExternalUserExpirationInDays aren't populated and can show default values.
Then test with an external account: share from the partner site with an allowed domain and confirm the guest signs in, then share with a blocked domain and confirm the error.
Troubleshooting
Sharing fails with a domain error. The recipient's domain isn't allowed in the SharePoint list or in the Entra collaboration restrictions. If the user is already in your directory, the share appears to succeed but the guest is blocked when they open the site.
Guests of a Microsoft 365 group can't open site content even though the site allows guests. The group's guest settings may prevent guest members from accessing group resources. Check guest access in Microsoft 365 Groups as well as the site level.
The Anyone link option is missing. Anyone links need both the organization and the site set to Anyone. If external sharing is limited to specific security groups, members of a group set to Authenticated guests only can share only with guests who authenticate.
An external user gets access denied on a link that used to work. After SharePoint OTP retirement reaches the tenant, users without a matching Entra guest account lose access to Specific people links. Create a guest account for the email address the item was shared with, or share one item with them again. The Purview audit log's sharing events help identify affected users.
A guest can't redeem an invitation. If you added their domain to the Entra block list, or removed it from an allow list, after the invitation was sent, redemption fails. Also check the Entra guest invite settings for the person who shared.
Guests still have access after you tightened settings. Allow up to an hour. Guest expiration doesn't apply to guests who had access before the policy was enabled; remove those guests from the site.
Checklist
- Entra invite settings chosen; Entra and SharePoint domain lists aligned.
- Organization levels for SharePoint and OneDrive no more permissive than needed.
- Sharing limited to security groups if required; guest resharing off.
- View-only default links; Anyone links view-only and expiring.
- Guest access expiration set; site owners know how to extend it.
- Root site, sensitive sites and partner sites reviewed and restricted.
- Guests from older SharePoint OTP shares given Entra guest accounts where needed.
- Settings verified with PowerShell and a test guest.
References
- Manage sharing settings for SharePoint and OneDrive in Microsoft 365
- Change the sharing settings for a site
- Microsoft Entra B2B integration for SharePoint and OneDrive
- Domain restrictions when sharing SharePoint and OneDrive content
- Allow only members in specific security groups to share externally
- Change the external sharing setting for a user's OneDrive
- Manage guest expiration for a site
- Configure external collaboration settings
- Allow or block invitations
- Set-SPOTenant
- Set-SPOSite
- Get-SPOSite