Allow Onedrive Folder Access to Upload Outside Organization

With its flagship productivity suite Microsoft 365 (formerly known as Office 365), Microsoft aims to break down the traditional business organisation silos that inhibit content sharing and collaboration. The interwoven capabilities of SharePoint Online and OneDrive for Business allow users to collaborate with a wide range of colleagues from both inside and outside their system.

Despite its benefits, file sharing poses several risks. What if your files are inadvertently or deliberately shared with the incorrect users? What if users mishandle sensitive information? How can yous stay in control of your guest users?

To mitigate security concerns around sharing, it'due south important to sympathize how to configure the two mechanisms of sharing in Microsoft 365:

Invitee access: Sharing content with guest members in Microsoft 365 groups or Microsoft Teams
External sharing: Sharing links to specific SharePoint and OneDrive avails with external parties

This article explains how to manage invitee users and external access in Microsoft 365 to ensure business continuity without compromising the security of your critical data:

Invitee Access in Microsoft 365
- How to Enable or Restrict the Guest Access Feature
- How to Add together a Guest User to a Group
- What Level of Access Does a Guest User Take?
External Sharing in Microsoft 365: SharePoint Online
- How to Manage Tenant-Wide Sharing
  - Using the SharePoint Admin Eye
  - Using the Microsoft 365 Admin Center
  - Using Azure Ad
- How to Manage Site-Level Admission in SharePoint Online by External Users
  - How to Change the External Sharing Setting for a Site
  - How to Restrict Admission to a Site based on the User Domain
External Sharing in OneDrive for Business
- How to Manage Tenant-Wide Sharing for OneDrive
  - How to Configure OneDrive Sharing through the SharePoint Admin Centre
  - How to Configure OneDrive Sharing through the OneDrive Admin Center
- How to Manage External Sharing for an Individual OneDrive
How to Mitigate the Risk of Unauthorized External Sharing of Disquisitional Data
FAQ

Guest Access in Microsoft 365

On the back finish, Microsoft 365 groups are objects in Azure Active Directory (Azure Advertisement). Each grouping object in Azure AD contains unique identifying information such as:

Information about the group owner
URLs for associated resources
Group membership list, including any guest accounts

How to Enable or Restrict the Guest Access Feature

By default, the guest access characteristic is enabled for a Microsoft 365 tenant, which means a Microsoft 365 grouping owner can invite anyone who has a business or consumer email account become invitee members of the group.

As a Microsoft 365 administrator, you can set the level of external access for the tenant by going to the Microsoft 365 Groups page in the Microsoft 365 admin center. Under Services and Add-ins, you lot can control whether to turn off invitee access entirely and whether grouping owners are immune to invite invitee users.

You can also use PowerShell to limit the policy on guest access. For case, you lot can:

Prevent guest users from accessing a specific group.
Cake external guests from a specific domain.

How to Add together a Guest User to a Group

Whatever group fellow member can nominate an Part 365 grouping external user for guest access, simply just the group owner tin grant guest admission. The process of adding a invitee user to a grouping proceeds as follows:

The grouping owner or a group member uses the Groups > Add Members command to nominate the external user for membership by inbound the user'south email address.
The group owner reviews the access permissions the guest would receive by joining and approves the nomination.
The invitee receives a welcome email and can begin participating in grouping activities.

What Level of Access Does a Invitee User Have?

Guest members of a Microsoft 365 grouping:

Don't accept direct access to any of the group's sites, such equally a team site in SharePoint
Tin can participate in group activities through conversations and group agenda invitations sent to their email inbox
Can access shared files included in email messages, such as attachments or links, provided the administrator has enabled the requisite file-sharing permissions

External Sharing in Microsoft 365: SharePoint Online

The external sharing capabilities of SharePoint Online can be managed at ii levels:

Across the unabridged Microsoft 365 tenant, through either the SharePoint Admin Eye, the Microsoft 365 admin center or Azure AD
At the site level

How to Manage Tenant-Wide Sharing

Using the SharePoint Admin Center

To configure external sharing settings for the unabridged tenant, go to the Sharing page of the SharePoint admin center. The External sharing section on this page contains options that let you lot control the tenant-wide sharing level in SharePoint:

Only people in your organization: Turn off external sharing and limit sharing to internal users merely. This is the default setting for communication sites and classic sites in SharePoint. As a security best practice, it'due south recommended that you plough off tenant-wide external sharing past selecting this choice.
Existing guests: Permit sharing with external users who accept already been added to your Azure Advertizement Existing guests may have joined your Azure Ad by accepting a share invitation in the past or past being added every bit guest users by an administrator in the Azure portal. This option requires guests to cosign into Microsoft 365 with valid credentials before they can admission shared avails.
New and existing guests: Grant site owners and users total command permission to share sites with external users. Site users can also share files and folders to collaborate with external users.
Anyone: Allow anyone with the resources link to access the resource and forward the link to others. This option is selected by default, but it's recommended that you change the external sharing setting to Merely people in your organization. Beware of leaving the Anyone option selected, equally it opens the door to uncontrolled sharing with anonymous, unauthenticated users and may put sensitive information at risk.

If you elect to allow sharing with Anyone, you lot can amend document management and security by configuring these recommended advanced settings:

Configure Anyone links to elapse after a certain period of fourth dimension.
Restrict guest links to let but view access to files and folders.
Restrict default links to be accessible to Only people in your system.
Enable the ATP safe attachments feature.
Restrict external sharing with users from blocked domains.

Using the Microsoft 365 Admin Heart

You can also configure tenant-level sharing for SharePoint by going to the Microsoft 365 admin center and selecting Settings > Services & add-ins > Sites. This page lets you configure the aforementioned external sharing options as the SharePoint admin center.

Using Azure AD

For the highest level of control over external access to SharePoint, configure sharing settings in Azure Advertisement. You lot tin approach the Azure AD sharing configuration in either of ii means:

Have SharePoint use its ain external sharing list, independent from Azure B2B, and configure organizational relationships settings in Azure Advertizing. Log in to the Azure Portal and select Azure Active Directory > Overview > Organizational relationships. Get to the Settings page and ascertain the SharePoint online external sharing settings yous want to use for your organization.
Accept SharePoint use the external sharing settings defined in Azure B2B and configure B2B collaboration in Azure AD.

Tip: The sharing settings configured in Azure AD override the sharing settings configured in the Microsoft 365 admin center or SharePoint admin center. For example, if y'all allow external sharing via the Microsoft 365 admin center merely disable external sharing through Azure AD, the Azure Advertizing setting takes precedence and external sharing will exist turned off for your arrangement.

How to Manage Site-Level Access in SharePoint Online past External Users

In addition to configuring tenant-broad sharing policies, you tin farther restrict external sharing for a specific SharePoint site. To exercise this, you must accept global admin or SharePoint admin privileges. Site owners cannot alter the external sharing setting for sites.

How to Alter the External Sharing Setting for a Site

In the SharePoint admin center, go to Sites > Active Sites.
Select the checkbox next to the site name.
Click the "i" icon at the tiptop right corner of the page.
Select the desired sharing level from the list of sharing options. These are the aforementioned 4 sharing options that are available for tenant-wide configuration.

Tip: The external sharing setting for a specific site has to be the same or more than restrictive than the tenant-level setting. For example, if tenant-broad sharing is limited to Existing guests, the sharing setting for a specific site can be changed to Only people in your organization, but it cannot be inverse to a more than permissive option such as Anyone.

In another typical employ case, a global or SharePoint admin needs to restrict external users in a certain network domain from accessing a specific site. For instance, users from the Customer A domain should non be able to access a site specifically designed for collaborative sharing with Client B.

How to Restrict Admission to a Site based on the User Domain

In the SharePoint admin eye, go to Sites > Agile Sites.
Select the checkbox next to the site name.
Go to the Policies tab.
Under External sharing, click Edit.
Nether Avant-garde settings for external sharing, select the checkbox next to Limit external sharing by domain.
Click Add together domains.
Select Let only specific domains.
Enter the fully qualified domain name (FQDN) of each domain yous want to add to the allow list. Only users from the listed domains will exist eligible for invitations to the site.

External Sharing in OneDrive for Business

OneDrive for Business is a personal repository that people can use to store and sync files beyond multiple devices. In this sense, OneDrive functions like a home directory or personal mapped drive that lets users save files in deject storage and retrieve them from any device.

Many customers too apply OneDrive to share items with other users, although OneDrive wasn't actually designed for this purpose. As an administrator, you can make up one's mind the level of access that external users have to OneDrive files in your system.

How to Manage Tenant-Broad Sharing for OneDrive

Tenant-broad sharing settings apply to all the OneDrive instances for users in your Microsoft 365 account. At that place are two portals through which y'all can configure these sharing settings for OneDrive:

The Sharing page in the SharePoint admin center (Microsoft recommends using this page to configure your OneDrive sharing settings)
The Sharing page in the OneDrive admin middle

How to Configure OneDrive Sharing through the SharePoint Admin Center

Follow the instructions and guidelines described earlier in "How to Manage Tenant-Broad Sharing Through SharePoint Admin Center." OneDrive provides the aforementioned four sharing options as SharePoint.

Tip: The sharing level for OneDrive must be the same equally or more restrictive than the sharing level for SharePoint. For instance, if tenant-wide sharing in SharePoint is set to Existing guests, you can only configure OneDrive to employ the aforementioned setting or the more restrictive Only people in your arrangement setting.

How to Configure OneDrive Sharing through the OneDrive Admin Middle

Log in to the OneDrive admin center.
Navigate to the Sharing

Here, you can set the level of external sharing for OneDrive and configure more than fine-grained sharing controls such every bit:

The type of link generated by default when a user shares a file
The expiration period for links
Whether to allow editing and uploading privileges for links that share OneDrive files or folders externally
Specific domains to let or block users from receiving sharing invitations
Whether external users must use the same business relationship to receive and accept sharing invitations
Whether external users tin share content they don't own
Whether content owners can audit the listing of users who have viewed their content

How to Manage External Sharing for an Individual OneDrive

To customize the sharing level for a specific user's OneDrive, use the Microsoft 365 admin eye:

Log in to the Microsoft 365 admin middle with global admin or SharePoint admin privileges.
Go to Users > Active users.
Select the OneDrive user for which you want to modify the sharing level.
Go to the OneDrive tab.
Select Manage sharing under the Sharing department.
Configure the external sharing level and save your changes.

Tip: The external sharing level for an individual OneDrive must exist the same as or more restrictive than the sharing level configured for OneDrive tenant-wide.

How to Mitigate the Hazard of Unauthorized External Sharing of Critical Data

Classifying your data will help you understand where your critical information resides, including whether a particular SharePoint Online site or site collection or a OneDrive for Business folder shared with external users contains sensitive data. This insight volition enable y'all to ready external sharing according to the sensitivity and value of information stored at that place.

To ensure comprehensive and accurate data discovery and classification, cull an advanced solution like Netwrix Data Classification. Its automated and highly accurate data tagging enables you to choose appropriate sharing settings and also enables users to easily find the data they need. The tagging will as well improve the effectiveness of the information loss prevention (DLP), information rights direction, records direction and other data governance solutions your organisation already using or planning to implement. You can too set up workflows that volition automatically motility overexposed information from SharePoint Online and OneDrive for Business repositories to a designated quarantine area.

FAQ

Who are invitee users in Microsoft 365?

A guest is any external user who has been granted permission by the owner of a Microsoft 365 group to participate in grouping conversations, calendar invitations, file sharing and notebook activities. Microsoft 365 invitee users are the same every bit Office 365 invitee users.

What is external sharing in Microsoft 365?

External sharing refers to the ability of SharePoint Online and OneDrive users to share admission links to files and folders with external users. SharePoint site owners tin likewise share site access with external users.

How do I get a listing of guest users in my Microsoft 365 tenant?

You tin can either:

Visit the Guests page in the Microsoft 365 admin middle.
Use PowerShell for Azure AD and run a script that systematically uses the Become-AzureADuser cmdlet and outputs the listing of guest users to a CSV file.

How do I discover out which external users have access to SharePoint Online?

Download the SharePoint Search Query Tool and follow the process described in this Microsoft support article to get a list of all the resources external users have access to.

Can I limit external sharing of files in Microsoft 365?

Yes, you tin plough off external sharing completely for your arrangement. There are as well means to limit external sharing. For instance, you can:

Only share to Azure AD guests who provide valid authentication credentials
Configure file-sharing links with view-only permissions
Block users in specific network domains from receiving sharing invitations

How do I manage external sharing in Microsoft 365?

Equally a global admin or SharePoint admin, you lot tin can manage external sharing using PowerShell or any of the following portals:

SharePoint admin center
Microsoft 365 admin center
OneDrive admin eye
Azure Portal

Jeff is a onetime Director of Global Solutions Engineering at Netwrix. He is a long-fourth dimension Netwrix blogger, speaker, and presenter. In the Netwrix blog, Jeff shares lifehacks, tips and tricks that can dramatically amend your system assistants experience.

grantagine1937.blogspot.com

Source: https://blog.netwrix.com/2020/05/26/microsoft-365-guest-users-and-external-access/