Forum Discussion
Microsoft Purview | Share block at external users
Hello community. I have an issue with Microsoft Purview DLP policies. I am trying to create a policy that prevents documents from being shared through OneDrive with external users, while allowing c...
| The Entra ID Guest object itself should not be the issue. A user with UserType = Guest is still treated as external for SharePoint/OneDrive sharing. The key points here are: The DLP rule should use the guest’s actual external SMTP address, not the generated #EXT#@tenant.onmicrosoft.com UPN. The OneDrive scope should contain the internal user who owns the protected document. The policy must be enabled, and the document must actually match the configured DLP conditions. With this action, the sharing invitation can still be created. Enforcement is validated when the external guest attempts to open, preview, or download the file. Since the issue has continued for several days, Purview Activity Explorer/Audit is the best place to confirm whether the rule matched the document and external user, and whether the block action was evaluated. So the likely issue is not the Guest account itself, but rather SMTP matching, policy scope, rule matching, or access-time enforcement. |