Inviting guest who already has a Microsoft account

RichardBergCNY 

First off, this probably doesn't answer your question, but hopefully it provides some insight that someone else can build upon. Also, I don't work for Microsoft.

There seem to be two categories of accounts in the Microsoft authentication world (based on my personal experience and the UI of their web and mobile apps):

1. "Personal" accounts (e.g. 'Passport', @live.com, @outlook.com, etc.)
2. "Work and school" accounts, which are backed by tenant-based Azure Active Directory instances

Some services only allow login with one type (PowerApps = "Work and school") while others allow both (e.g. Outlook, Excel, MS Edge profile sync).

Example scenario:

Let's say I am the administrator of a new tenant called ContosoCharity.org:

• I set up a new user, Bob, at bob@contosocharity.org
• Bob's wife, Mary, is COO at Contoso Heavy Industries, and has an existing account on their tenant as mary@contosohi.co.jp.
• Bob's daughter, Karen, has a Gmail account she uses for school and YouTube, at FictionalKaren@gmail.com.
• Bob's son, Johnny, has a "personal" Microsoft account that he uses mostly for Xbox and GitHub at FictionalJohnny@live.com.
• Also, I have set up federation in Azure Active Directory to allow Gmail users to authenticate directly with Google.

Now, all of these folks volunteer for my charity, and Bob is on the board of directors. I share a SharePoint site with Bob and his family members - they each receive an e-mail invitation.

1. Bob clicks on the invitation,
   1. is prompted for his existing bob@contosocharity.org credentials,
   2. and receives access to the SharePoint site.
   3. His account already existed in AAD so nothing changed there.
2. Mary clicks on the invitation, 
   1. is prompted for her existing mary@contosohi.co.jp credentials,
   2. receives access to the SharePoint site,
   3. and is added to the contosocharity.org AAD as either (depending on tenant settings?)
      1. mary_contosohi.co.jp#EXT#@contosocharity.org, or ...
      2. mary_contosohi.co.jp#EXT#@contosocharity.onmicrosoft.com
   4. Because her account can be authorized through another AAD tenant, she was not prompted for a _new_ password. The ContosoHI.co.jp AAD remains her authentication provider.
3. Karen clicks on the invitation,
   1. is redirected to a Google sign-in screen where she logs in with the Google password for her FictionalKaren@gmail.com account
   2. is redirected back to Microsoft and receives access to the SharePoint site,
   3. and is added to the contosocharity.org AAD as either
      1. fictionalkaren_gmail.com#EXT#@contosocharity.org, or ...
      2. fictionalkaren_gmail.com#EXT#@contosocharity.onmicrosoft.com
   4. Because her account was able to be authorized through the Google connection I previously enabled in AAD, she was not prompted for a _new_ password either. Google remains her authentication provider. 
4. Johnny clicks on the invitation,
   1. is welcomed to Microsoft and asked to set up a new password (the situation of the original thread poster above).
   2. Once complete and verified, he receives access to the SharePoint site,
   3. and is added to the contosocharity.org AAD as either
      1. fictionaljohnny_live.com#EXT#@contosocharity.org, or ...
      2. fictionaljohnny_live.com#EXT#@contosocharity.onmicrosoft.com
   4. Since Microsoft keeps "Personal" accounts separate, Johnny will have to remember and maintain a separate password for contosocharity.org
5. If one of the external users needs a license to access shared resources, I can purchase one and assign it to them through either the Microsoft Admin Center or the AAD blade on the Azure Portal.
   1. Mary shouldn't need a license at ContosoCharity.org for most things, since she has an Office 365 E5 license at ContosoHI.co.jp already.

Issues:

User confusion: people using "personal" Microsoft accounts to access "Work or school"-type resources / tenants / domains

SharePoint. Anything based upon SharePoint seems to hate these external users. In the web UI, the user panel on the top-right screen shows the 'ugly' AAD version of their username (e.g. mary_contosohi.co.jp#EXT#@contosocharity.onmicrosoft.com ), and it is currently impossible to for these users to log in using certain mobile apps (e.g. PowerApps with a data connection to a SharePoint list) even though those same users can access the exact same resources perfectly fine using the web apps. This appears to be at least partly because the mobile apps (at least on iOS, such as Authenticator) don't accept the # character as a valid part of a username.

Conclusion:

Your guests with Microsoft accounts through their employers should probably be fine.

Apologies for not being able to help further; I'm still struggling to understand this all and get it implemented myself. Best of luck to you!

 - Jim

(If anyone has any further insight, please add to this discussion or cross-post/link as necessary. - Thanks!)