Forum Discussion
Microsoft Purview | Share block at external users
Hello community.
I have an issue with Microsoft Purview DLP policies.
I am trying to create a policy that prevents documents from being shared through OneDrive with external users, while allowing certain exceptions. However, when I select the option "Block Access to external domains and users" and assign a specific email address to be blocked, it does not work. The configured email address is not being blocked.
I was reviewing this with Copilot, and it mentioned that if the external user you are sharing with already exists in Entra ID, the tenant may treat the user differently (not necessarily as an external user). My external user exists in Entra ID as a Guest account.
The external user is registered as follows:
Displayname: User Name
Userprincipalname: user.name_external.domain#EXT#@company.onmicrosoft.com
User Type: Guest
Has anyone else experienced this issue? I am sharing evidence of the policy configuration.
7 Replies
The Entra ID Guest object itself should not be the issue. A user with UserType = Guest is still treated as external for SharePoint/OneDrive sharing.
The key points here are:
The DLP rule should use the guest’s actual external SMTP address, not the generated #EXT#@tenant.onmicrosoft.com UPN.
The OneDrive scope should contain the internal user who owns the protected document.
The policy must be enabled, and the document must actually match the configured DLP conditions.
With this action, the sharing invitation can still be created. Enforcement is validated when the external guest attempts to open, preview, or download the file.
Since the issue has continued for several days, Purview Activity Explorer/Audit is the best place to confirm whether the rule matched the document and external user, and whether the block action was evaluated.
So the likely issue is not the Guest account itself, but rather SMTP matching, policy scope, rule matching, or access-time enforcement.The Guest account itself is probably not the issue here.
An Entra ID user with UserType = Guest is still considered external by Microsoft 365/Purview. The #EXT# account created in the tenant does not make that user internal.
A couple of things are worth checking:
- Use the guest's real external SMTP address in the DLP rule, for example email address removed for privacy reasons, not the generated user_externaldomain.com#EXT#@tenant.onmicrosoft.com UPN.
- With “Block access for specific external domains or users”, DLP does not necessarily prevent the owner from creating the sharing link or sending the invitation. The expected enforcement happens when the targeted external user tries to open, preview or download the file. The proper test is therefore to sign in as that external user and try to access the shared document.
- Make sure the policy is actually enabled, not only in simulation/test mode, and allow time for the policy to propagate.
- Test with a supported document type such as DOCX, XLSX or PDF rather than an image.
MarkNewFilesSensitiveByDefault = BlockExternalSharing can also be useful, but it solves a different problem: it blocks external access to newly uploaded files while Purview is still scanning/classifying them. It should not be required simply to make a specific external-user block work.
So I would first verify:
external SMTP address -> active DLP policy -> share the document -> log in as the Guest -> attempt to open/download it.
If the Guest can still access the file after that, the next useful evidence would be the matching event in Purview Activity Explorer/Audit, because that will show whether the DLP rule was evaluated and why it did or did not match.
In my experience, it takes few days for such policy to start working as expected, regardless of what the policy sync status says. Leave it over the weekend and see how it behaves.
Thanks VasilMichev I'll wait some days.
Did it work? If not, read
https://learn.microsoft.com/en-us/sharepoint/sensitive-by-default
