Forum Discussion
Best practices: Open OneDrive/SharePoint sharing but restrict Teams guest access by domain
What you really need to do is to control Entra B2B guest invitation.
Teams ad-hoc chat/meeting - does not require B2B account creation
Sharepoints OTP ad-hoc based sharing - does not require B2B account creation, but this is in the process of being deprecated
Teams "guest access" to internal teams and collaboration - this requires B2B guest invitation
So, you just have to control who can invite B2B guests and that essentially controls which B2B guest can be added to internal Teams. The only gotcha you need to review with user is if they're actually using SharePoints OTP ad-hoc sharing or more B2B guest user based sharing.
Hi yhl,
Thank you for your reply.
I think this is exactly where our challenge comes from. Historically, we also relied on OTP-based sharing and treated SharePoint/OneDrive sharing separately from Entra B2B guests.
However, Microsoft recently confirmed that when Collaboration Restrictions are configured as "Allow invitations only to the specified domains", OneDrive and SharePoint sharing to external users outside the allowlist is blocked as well, as these scenarios now use the same Entra B2B invitation framework.
(Reference: Answer from "Liora D" in https://learn.microsoft.com/en-us/answers/questions/5954975/onedrive-external-sharing-no-longer-working-with-a)
Because of this, we're no longer looking for a way to control who can invite guests, but rather for a way to achieve the following at the same time:
- Allow OneDrive and SharePoint sharing with users from any domain.
- Allow Teams external chat and meetings with users from any domain.
- Restrict Entra B2B guest accounts that can be added to Teams to approved domains only.
At the moment, it seems that restricting Collaboration Restrictions also restricts SharePoint and OneDrive sharing, which is exactly what we are trying to avoid.