Self-prevision guest account to AzureAD from ODFB sharing, but not MS Teams guest invitation

[Ming Zhang]

Our Tenant currently has "Sharing - Let users add new guests to the organization" set to Off.  All the external sharing settings for SharePoint/OneDrive for Business (ODFB) and Microsft Teams guest are set to on to the maximum permissive level. When users share a file in ODFB to a specific external user who has an external Microsft account, such as Hotmail account, or another O365 Tenant account, the account will be automatically added as Azure AD guest. However, in Microsoft Teams when users add a guest user as the Teams member who has a different O365 Tenant account, the guest user has to already exist in the Azure AD or it will report no permission. The account cannot be automatically added to Azure AD as a guest user. I wonder how come ODFB can override the Tenant level setting "Sharing - Let users add new guests to the organization", which cause the inconsistent behavior and hard to control the guest provision?  Is there any way to disable this gust account self-provision with ODFB but not affect it guest link sharing? 

[#2]

You're right - it is inconsistent.
It's because they are different types of guest mechanisms.
When inviting a guest into a Team, it's adding them into a Group which is based on AAD - and that functionality is disabled.
When sharing with someone externally it creates an object of the user in the AAD but it's not the same (but kind of is) as that user can't access any other resources.

[#3]

But this creates a loophole. Let's say I am an Office 365 end user on our Tenant, where "Sharing - Let user add guest" is off.  I try to invite an external gust into a Microsoft Teams. Because "adding a guest" is not allowed, which is intended, I cannot add any new external users to the Teams but can add only those guest users who are already in our Azure AD.  As a workaround, I can just to go to my ODFB and pick a file and share it with the same external users that I planned to invite to the MS Teams. The external user accepts ODFB sharing and he/she would then be added to our Azure AD as a guest. After that, I can easily add the guest to the Teams without Administrator involvement, and thus avoid the blocking setting of "adding guest".   

My question here is that how to block the ODFB adding guest users but still allow shareable links.

Thanks 

[#4]

You can't block ODFB from adding guest users, as they are an artefact left over from the sharing process.