Best practices: Open OneDrive/SharePoint sharing but restrict Teams guest access by domain

Hi yhl​ 

Thanks for your input.

I agree that controlling who can invite Entra B2B guests is an important part of the solution. However, our challenge is slightly different.

Historically, we relied on SharePoint/OneDrive OTP-based sharing as well. The issue we are seeing now is that Microsoft confirmed that when"Allow invitations only to the specified domains" is configured in Entra B2B Collaboration Restrictions, OneDrive and SharePoint sharing invitations are evaluated against the same Entra B2B framework and are therefore blocked for domains outside the allowlist.

Our goal is to achieve all of the following simultaneously:

• Allow OneDrive and SharePoint file sharing with external users from any domain
• Allow Teams external chat and meetings with users from any domain
• Restrict Entra B2B guest accounts that can be added to Teams to approved domains only

Based on Microsoft's response, there currently does not seem to be a supported way to apply domain restrictions only to Teams guest scenarios while allowing SharePoint and OneDrive invitations to bypass the same Entra B2B restrictions. SharePoint guests, OneDrive guests, and Teams guests now appear to rely on the same underlying Entra B2B invitation framework.
https://learn.microsoft.com/en-us/answers/questions/5954975/onedrive-external-sharing-no-longer-working-with-a

So unless I'm missing something, controlling who can invite B2B guests alone would not solve the problem, because the domain allowlist itself is what prevents OneDrive and SharePoint sharing to external users outside the approved domains.

Have you seen a configuration where OneDrive/SharePoint sharing remains open to any domain, while Entra B2B guest creation is restricted to a defined set of domains?

Thanks!