Groups Guest access and SharePoint access

Steel Contributor

Looking to confirm my understanding.  If you add a guest to an O365 from OWA, they will only have access to the associated SharePoint site if external sharing for that site has been turned on (or if external sharing was turned on a the tenant level)?  Since sites created off of groups don't show up in the SharePoint Admin center, you'd have to run PowerShell to enable external sharing on that site?  Is there any other way to grant external member access to a Groups SharePoint site besides PowerShell? 

41 Replies

@Jens Skov

 

"By default, all SharePoint site collections that are part of an Office 365 Group have the sharing setting set to Allow sharing only with the external users that already exist in your organization’s directory. To change this setting, you can use the Set-SPOSite Windows PowerShell cmdlet." from https://support.office.com/en-us/article/Manage-external-sharing-for-your-SharePoint-Online-environm...

 

Hence, to share with unauthenticated users, it is enough to change the default by powershell.

Awesome! That was exactly what I was looking for! Thank you!

Any updates to this @Sahil Arora? I'm starting to get a lot of users trying to share individual files from their modern team sites that are created as part of an Office 365 Group, who are getting the error which makes it look like external sharing is disabled when it actually isn't. This is generating a lot of tickets and complaints to our support function as users are used to external sharing in SharePoint and would like to share individual files that way as opposed to sharing the file contents of their entire Group.

Hi David, We totally understand the gravity of this issue & we are actively working on to support this item.

 

Thanks,

Sahil

I am still having issues (and lots of support tickets) as Guest members of a new Group cannot access the Groups SharePoint files. Referring to the article mentioned below:

 

The article says: By default, all SharePoint site collections that are part of an Office 365 Group have the sharing setting set to Allow sharing only with the external users that already exist in your organization’s directory. To change this setting, you can use the Set-SPOSite Windows PowerShell cmdlet.

 

Q: If I change the Tenant (global) settings, do I still have to change the settings for the site collections related to the Office 365 Groups with the SPO cmdlet?

 

NB: I ask this as I do not see an obvious Site Collection in the list of Site Collections that is related to my Office 365 Groups (for example storage used is zero when there are many files in the Group site) - related, where do I see the storage used for the SharePoint files associated with a group?

Didn't hear back so I Set-SPOSite -Identity https://xxx/sites/yyy -SharingCapability ExternalUserAndGuestSharing The SP article on this https://support.office.com/en-us/article/Manage-external-sharing-for-your-SharePoint-Online-environm... is not clear which capability maps to which value to use and has no date so who knows if it is in sync with Groups :(

Hi David-

We are also experiencing this issue and running SPOSite is not working as suggested in prior posts. Unless the user is already registered in Azure AD there is no way to share a file or folder from an Office 365 Group Team Site without receiving that dreaded message.  Our requirements are similar to most, where Group Owners want to only share select Folders/Files with external users with having to add to the external user to the Office 365 Group. 

 

I am hoping this much needed feature is coming soon.

 

Best,

Bobby

HI @Bobby Cruz.

As already said in this thread and in several other threads, in order to share Group files and folders with external users not members of the Group itself, two conditions should be met:

  1. External sharing should be enabled at tenant level in Admin Center
  2. External sharing should be enabled at Group level by PowerShell

Follow carefully, step by step, the various sections in this article: https://support.office.com/en-us/article/Turn-external-sharing-on-or-off-for-SharePoint-Online-62882...

If it doesn't work, then double-check your steps: it MUST work if everything is well done.

Good luck.

Hi Salvatore,

Yes, I am aware of the two conditions and although I have confirmed it does not seem to work

 

I will give it a go again and see if the outcome is different.

Best,
Bobby


Best,
Bobby

Very strange!

It looks like a bug: have you tried to open a ticket with support?

Hi Salvatore,

I am going to try again today. I haven't reach the point of frustration just yet, but if the outcome turns out to be the same I will likely open a ticket with support to take a look. 

 

Best,

Bobby

Hi Salvatore,

Well I am happy to say that I figured out how to get External Sharing for Guests working for my groups Office 365 Team Site. 

 

Scenario-

Unable to Share a Group Folder or File with External Users (Guest)

Guest Sharing Enabled at the Tenant Level - Yes

Executing Set-SPOSite -SharingCapability  ExternalUserAndGuestSharing - Did not work, message still indicated I needed to EnableGuestSharing at the Tenant Level (Although it already was).

 

What worked for me was executing the following command from PS to enable guest sharing.

set-spotenant -SharingCapability ExternalUserAndGuestSharing

then running this against the site I want to enable guest sharing

set-sposite https://site.sharepoint.com/teams/development -SharingCapability  ExternalUserAndGuestSharing

 

 

 

Long story short, although guest sharing was enabled in the Admin Center, for whatever reason, PS still saw this setting as "off". By enabling this setting using SET-SPOTenant worked.

 

 

Happy to know that you solved the issue!

Regards.

Hey Dave,

Run this first after you are authenticated with your tenant using PS.

when using connect-sposervice the -Url switch should point to your group team site not your SharePoint Admin Url

set-spotenant -SharingCapability ExternalUserAndGuestSharing

then

set-sposite https://yoursite.sharepoint.com/teams/development -SharingCapability  ExternalUserAndGuestSharing

Although External Sharing is enabled in the Admin Center, running SPOSite -SharingCapability  ExternalUserAndGuestSharing never worked.

 

Enabling External Sharing via PS using SPOTenant level worked. 

 

I hope this works for you.

 

Best,

Bobby

 

 

Thanks Salvatore!

 

So am I!!!

I know you have probably answered this a 100 times, but I still have to ask. 

 

  1. If you turn off Sharing to external users in the SPO Admin Center, will this block sharing with guests in Office 365 Groups Site Collections?
  2. If you turn of External Sharing on the root SPO site, will this block sharing with guests in Office 365 Groups site collections?

 

This is the scenario a client wants to turn off sharing outside of the organization on the root site, and allow external sharing, for Office 365 Groups Site Collections.   Is this even possible?

@Bryan Hughes

  1. Yes. The sharing setting in individual site collections cannot be less restrictive than global setting in SPO Admin Center. So, if you switch off sharing at the global level it will not be allowed for the individual site collections (including those connected to Groups).
  2. No. The sharing setting of every site collection (including the root site collection and those connected to Groups) is individual.

So what you want is feasible: enable globally sharing with external users in the Admin Center, disable it for the root site collection and enable it (by PowerShell) for individual Groups.

 

Hope it helps...

@Salvatore Biscari Thank you very much.

 

I had already tried it with a test group and root site after I posted the question and it worked, but it is nice to see confirmation, from an expert.

 

The MSFT documentation on SPO Sharing and Office 365 sharing is confusing and circuitous.

Hi Bryan,

I apologize for not responding sooner, I was away on business. @Salvatore Biscari provided an awesome overview.

Glad is all worked out!

 

Best,

Bobby

Hi Bryan,

I apologize for not responding sooner, I was away on business. @Salvatore Biscari provided an awesome overview.

Glad is all worked out!

 

Best,

Bobby