Guest Access - Restrict Guest Access / Governance

abdullah202025 

Hi, OK so some possible options for you;

1). In order to use site specific sharing capabilities, you need to work from the principle of allowing sharing and being least restrictive from a tenant wide point of view, and then apply more strict permissions at Site level.

So at a tenant level, you would need things pretty open as shown below;

Then at the Site level, use the Site Permissions option from the cog wheel and you will have the options below.

2). A good way to track and review permissions granted to guest accounts is to use Azure AD Access Reviews as per https://docs.microsoft.com/en-us/azure/active-directory/governance/access-reviews-overview.  You would need an Azure AD Premium P2 licence to use this feature however.

3). I would suggest access reviews again for this,

4). Yes, you can protect Sites with Sensitivity labelling now, and control guest access in this manner.  Check out my blog on this subject - https://practical365.com/sharepoint-online/using-sensitivity-labels-with-sharepoint-sites-microsoft-teams-and-m365-groups-part-1/

5). DLP will help with the accidental sharing of information for sure, so I would always advise looking into these.  Sensitivity labelling at both the container level, and the document and email level are also a very good means to protect your data and ensure it can only be accessed by those authorised to do so.

Hope this helps.