Introducing guest access for Office 365 Groups!

[Kady Dundas]

Today, we announced the new guest access feature for Office 365 Groups, the group membership service that provides a single identity for teams in Office 365. The new guest access feature gives you the ability to include people outside of your company in an Office 365 group.

• Get the details in this blog post
• Learn more about collaborating outside the firewall with Office 365 Groups at this session at Ignite
• Check out the whole lineup of sessions on Office 365 Groups at Ignite here!

@Christophe Fiessinger @Shashi Singaravel

[#2]

Will this take some hours or days to show up? Not seeing the Share section under Setting & privacy in Admin center yet ...

[#3]

Yes it will take some time as we are rolling out the feature, in the mean time if you would like to access this settings you could do that via Azure Portal (http://manage.windowsazure.com) under Configure>User Access section - "Allow New Invitations".

[#4]

Awesome news, gratz all for the milestone! We all know how many times it has been requested :)

=====================

Reposting from the comments on the blog article:

The one part not clear to me is what kind of access they will get by default? And can we control that so we don’t end up with the “guest user deleted all the Group files” scenario?

The help articles indicate that this might be possible by controlling the settings template, however I cannot see any matching option.

Also, might be a good idea to update the help articles with the instructions on how to control Guest access per group (the 08d542b9-071f-4e16-94b0-74abb372e3d9 template).

[#5]

That doesn't work either.  All 3 flip switches are enabled and still get the error message that you can only add people inside your organization.

[#6]

David, we are still in the process of rolling out this feature, so it might take hours/days before you can see this feature light up in your tenant.

[#7]

Must be something else needed; tried weith all three as yes and also with LIMIT GUEST ACCESS as NO.

[#8]

Great news to see this shipping, can't wait to see it.

Reading the documentation I think it's pretty confusing in the admin help at https://support.office.com/en-gb/article/Guest-access-to-Office-365-groups-Admin-Help-7c713d74-a144-...

The titles for the two section mean the same thing don't they ?

Use PowerShell to control guest access to all Office 365 groups in your organization
Use PowerShell to control adding guest users to all Office 365 groups in your organization

Isn't the second section about setting up groups so you could grant guest user access on a per group basis, rather than whole tenant. It's pretty confusing.

[#9]

Hi. I followed you link and I'm not finding Configure : User access on either the new or the old Azure portal?

[#10]

From the blog post: "Guest access works for any email accounts including corporate and consumer domains (such as Outlook.com or Gmail.com). If the guest email identity is associated with a Microsoft account (such as Office 365 or Outlook.com accounts, for instance), the user is directed to a sign-in page to identify themselves. If the guest doesn’t have a Microsoft account, they will be directed to a sign-up page to create an account."

Decoding it:

Guest access requires either an O365 account or an MS account. If a user does not already have one of these accounts, then he/she MUST sign-up for an MS account before being able to access a Group as a guest. As usual, it is possible to sign-up for an MSA using any email account, including corporate and consumer domains.

Correct?

[#11]

Does https://azure.microsoft.com/en-us/documentation/articles/active-directory-create-users/ help?

I see the settings (still in Preview) by going to the portal, selecting the AAD instance for my tenant, and then selecting the Configure tab. The User Access settings are towards the end. I don't think you need to go near these settings because the default values should allow guest access.

[#12]

Thanks TOny, I have that all set - as you said they were already set. I could not find those settings in the new portal, only the old portal.

(side note - thanks for the screen shot you attached. I only noticed it when coming back to reply. They don't feature very prominently do they.... Attached images should really show a thumbnail)

I am seeing 'All/Owners/Guests' in the group I've set up, but still get a warning that only individuals from within the organisation can be added when I try to add someone external.  

I realise it might be a number of days away. Is there any visual indication to know external group membership is active on your tenant, or do we just keep trying until it works?

[#13]

What does your AAD policy for groups show when you look at the settings using 

Get-MsolAllSettings | ForEach Values?

You need:

• AllowToAddGuests is True, meaning that guest users are allowed for this tenant.
• AllowGueststoAccessGroups is True, meaning that guest users can access Office 365 Groups.

I have been using this feature for the last month or so with a lot of success. For instance, with a team of people from Microsoft and other companies to build the "Field Guide to Office 365 Groups" session for Ignite. The "flighting" of the feature to First Release tenants takes time as multiple components have to be in place for everything to work and when they all come together, you'll be able to use guest access as documented.

FWIW, I have an article coming on Petri.com today that describes my experience of using guest access and some of the twists along the way. You might get some value from that text. And of course, we will have an update for the Office 365 for IT Pros eBook that covers this topic in depth. I think we'll release an update for the PDF, EPUB, and Kindle versions of the book next Monday.

TR

[#14]

In powershell I can get Get-MsolPartnerInformation and various other cmdlets to work, but not Get-MsolAllSettings. Is there a module that I need to install?

I'll keep an eye out for your post

[#15]

Aargh :( Why does posting a reply fail so often. "Correct the hilighted errors and try again" - there aren't any!!

[#16]

You need version 1.1.130.0 of the Azure AD PowerShell module to maintain AD policies like the one used by Office 365 Groups...

To test what you have:

[PS] C:\> (Get-Item C:\Windows\System32\WindowsPowerShell\v1.0\Modules\MSOnline\Microsoft.Online.Administration.Automation.PSModule.dll).VersionInfo.FileVersion

(all explained in chapter 5 of Office 365 for IT Pros...)

[#17]

Man this reply editor is buggy. It never works

[#18]

Ah even better, it tells you it isn't working - but it is. Sorry for the spam people.

[#19]

Thanks for your help Tony. Now I'm getting an authentication error, regardless of which admin username and password I use. 

[#20]

IN AD CONFIGURE USER ACCESS, should Limit guest access be ON or OFF - seems it should be OFF?