Forum Discussion
Groups Guest access and SharePoint access
Looking to confirm my understanding. If you add a guest to an O365 from OWA, they will only have access to the associated SharePoint site if external sharing for that site has been turned on (or if external sharing was turned on a the tenant level)? Since sites created off of groups don't show up in the SharePoint Admin center, you'd have to run PowerShell to enable external sharing on that site? Is there any other way to grant external member access to a Groups SharePoint site besides PowerShell?
As I understand my issue is not exactely what you are discussing, but I will chime in anyway.
We have the need to create links to files in a group library for unauthenticated access. Do I understand the thread right in assuming that this is not possible?
This means that right now the users are creating files structures in their own OneDrive that they are sharing with the Group and using the Shared With Us view.
What is very messy and takes away a lot of the advantages of the group, bus the external sharinng links are crucials for this organisation.
Can anyone help?
"By default, all SharePoint site collections that are part of an Office 365 Group have the sharing setting set to Allow sharing only with the external users that already exist in your organization’s directory. To change this setting, you can use the Set-SPOSite Windows PowerShell cmdlet." from https://support.office.com/en-us/article/Manage-external-sharing-for-your-SharePoint-Online-environment-c8a462eb-0723-4b0b-8d0a-70feafe4be85?ui=en-US&rs=en-US&ad=US
Hence, to share with unauthenticated users, it is enough to change the default by powershell.
I am still having issues (and lots of support tickets) as Guest members of a new Group cannot access the Groups SharePoint files. Referring to the article mentioned below:
The article says: By default, all SharePoint site collections that are part of an Office 365 Group have the sharing setting set to Allow sharing only with the external users that already exist in your organization’s directory. To change this setting, you can use the Set-SPOSite Windows PowerShell cmdlet.
Q: If I change the Tenant (global) settings, do I still have to change the settings for the site collections related to the Office 365 Groups with the SPO cmdlet?
NB: I ask this as I do not see an obvious Site Collection in the list of Site Collections that is related to my Office 365 Groups (for example storage used is zero when there are many files in the Group site) - related, where do I see the storage used for the SharePoint files associated with a group?
Sahil AroraMicrosoft
Thanks guys for the feedback! Couple of things, we have been working internally to rationalize this settings & this is the plan of record as of now.
1. By-default Groups have guest access enabled & the corresponding team site as well.
2. Currently by default files cannot be shared with new guests unless they are member group. We are planning to *change* this default with full guest access enabled, so that you can share indivudal files with new guest users through SPO.
3. The way we want SPO settings & Groups settings for short-term is to be decoupled with the right messaging in the admin portal so that admins are clearly aware of what do they need to do to fully disable guest access.
- David Rosenthal
Any updates to this Sahil Arora? I'm starting to get a lot of users trying to share individual files from their modern team sites that are created as part of an Office 365 Group, who are getting the error which makes it look like external sharing is disabled when it actually isn't. This is generating a lot of tickets and complaints to our support function as users are used to external sharing in SharePoint and would like to share individual files that way as opposed to sharing the file contents of their entire Group.
Hey Dave,
Run this first after you are authenticated with your tenant using PS.
when using connect-sposervice the -Url switch should point to your group team site not your SharePoint Admin Url
set-spotenant -SharingCapability ExternalUserAndGuestSharing
then
set-sposite https://yoursite.sharepoint.com/teams/development -SharingCapability ExternalUserAndGuestSharing
Although External Sharing is enabled in the Admin Center, running SPOSite -SharingCapability ExternalUserAndGuestSharing never worked.
Enabling External Sharing via PS using SPOTenant level worked.
I hope this works for you.
Best,
Bobby
Thanks Sahil.
About #2, my understanding is that today, by default, files can be shared with all existing external users, and not only with group members. Am I wrong?
Thanks for this great update Sahil Arora do you have an ETA about when this will be rolled out?
- My understanding is that is enough with enabling external guest at the tenant level so you don't need to run any PowerShell to configure Group sites
Hi Juan.
External sharing must be enabled at the tenant level AND at the Group site collection level (which BTW is the default) in order to allow access to guest members.
Thanks. We have external sharing disabled at the tenant level, are only enabling for specific sites. I added my personal external email to a Group I created, was able to conversate okay but got an access denied when trying to access the site. Sounds like then that would be expected? Until I turned on external sharing at the site collection level?
The default setting for sites associated to Groups is ExistingExternalUserSharingOnly and you don't need to change it in order to add external members.
If you want to change it, though, you can do it only by PowerShell.
