Sharing to External Users in an Office 365 Group

[Eric Adler]

I am still confused about the ability to share with external users. I have been able to successfully share with a gmail, hotmail, and other "consumer" providers.

I am not successful with other Office 365 external users.

Is this a supported scenario? I have my tenant and I want to add joe@somegreatcompanyono365.com and can't but i can add the same "joe"@hispersonalemail.com?

The error messaging compounds my confusion.

As I add the person I see this:

So I go to my admin center as told and....

And for the finalle the SharePoint additonal settings:

I am obviously missing something...

Any suggestions are much appreciated!

Thank you,

eZe

[#2 · Accepted solution]

Have you manually enabled (by PowerShell) the external sharing for that Group?

See https://support.office.com/en-us/article/Turn-external-sharing-on-or-off-for-SharePoint-Online-62882...

[#3]

I knew Salvatore was going to provide a super-fast answer :)

[#4]

I have not. I will give that a shot.

You guys rock!

[#5]

According to the article shouldn't my Tenant settings allow this? I will give it a try though!

[#6]

No. The tenant setting is necessary, but not sufficient.

You have also to enable sharing individually for each Group.

"By default, all SharePoint site collections that are part of an Office 365 Group have the sharing setting set to Allow sharing only with the external users that already exist in your organization's directory. To change this setting, you can use the Set-SPOSite Windows PowerShell cmdlet." (from the article cited above)

[#7]

I understand your point, Salvatore, and the article you point out states it clearly, but I also had the same problem and misunderstanding that Eric had, and while now I know the solution (based on your fine response), I also believe the UI in the Admin Center should be updated. While a couple of different UserVoice entries say that this has been done, that is because now the PowerShell is available.
To the SharePoint UX designers, if the goal is to get users to understand that a document library in a site is a document library in a Group is a document library in a Team, then can we get consistent UX around their permissions? And, if the answer is, "When we ship external user support for Teams then all will be resolved and will be beautiful," then "Thank You In Advance"!
--Owen

[#8]

To be fair, MS has promised some time ago in a thread here that the default for Groups will be changed to allow anonymous sharing. But then I guess that someone will complain about this choice... ;)

So, the best thing would be to have all defaults configurable in the Admin Center UI. But then I guess that someone will complain that he/she has shot himself in the foot... ;)

[#9]

Do you get the same issue when you are in a Group in outlook on the web and try sharing to an external user from there?

[#10]

Yep. Same thing.

[#11]

Eric, Are you saying that even after applying the PowerShell change to the group, you are still unable to share with an external user with a Work or School Account?
--
Set-SPOSite -Identity https://contoso.sharepoint.com/sites/site1 -SharingCapability ExternalUserAndGuestSharing
--

[#12]

No I haven't run the PowerShell script yet. I will give it a shot!

It should work with any user right? Not just work or school account, correct?

Thanks Owen!

[#13]

Yes, it will allow sharing with every MSA or Work and School Account.

If you don't run the PowerShell command, you will be able to share only with external users already existing in your directory, if any.

[#14]

Is it just me or does this all sound completely bonkers?  As a small business, we don't have an IT department and I'm responsible for keeping things running.  I can generally find my way around the Admin Centre, but have never used PowerShell and don't see why I should need to.  All the Admin Centre settings are set so that external sharing should work ... but it doesn't ... and the answer is to use PowerShell!?!?  If the Admin settings only do half the job, why bother having them at all, why not just tell customers that they can only do external sharing if they get a highly paid SharePoint administrator who knows how to use PowerShell ... or have I missed something?

[#15]

Hi Oz.

The actual trend is to require PowerShell for all "advanced" settings. Only "basic" settings are configurable in the Admin UI. (Of course it is arguable what is "basic" and what is "advanced"...)

Also, it is quite common to require PowerShell in order to tweak settings for new features: the corresponding Admin UI is often introduced later.

Hence, IMHO, you should start to learn the basics of PowerShell: it should not be so difficult...

[#16]

Well, I've just spent 45 minutes on the phone to a very helpful Microsoft Tech.  For the benefit of others, I'd summarise as follows:

• All the sharing settings in the Admin Center and SharePoint Admin Center are just to setup sharing options at the very top (tenant) level.
• If you then need to share content from a specific group with external users you need to turn on this ability using Powershell (I still think that's bonkers, but hey, ho).
• The Powershell code (to be run as an admin) is:
  • a. Set-ExecutionPolicy Unrestricted
  • b. $UserCredential = Get-Credential
  • c. Connect-SPOService -URL https://<domain>-admin.sharepoint.com
  • Set-SPOSite -Identity https://<domain>.sharepoint.com/sites/<sitename> -SharingCapability ExternalUserAndGuestSharing

Now, this didn't work for me first time as it said I was restricting settings to lower options than in the SharePoint Admin Centers.  I therefore changed access in there to allow anonymous access, ran the code again and then changed the Admin Center setting back.

All now works perfectly!  Hurrah.

Thanks for the input from people on here.

[#17]

This worked for me!

[#18]

Just ran the same script and it worked like a charm.  Only my second time using PowerShell so I'm pretty excited.  Seems like when dealing with Groups, PowerShell is the best option.  I just recovered a deleted Group using PowerShell (my first PowerShell adventure).  

[#19]

Why Microsoft, why?! This is so stupid. Seriously, every time a new team is created I have to run a powershell script to enable external sharing with new external users?! What a waste of time.

[#20]

@Oz Oscroft and others - I was having similar frustrations but found from the Microsoft documentation (scroll down to the -SharingCapability switch section) we have another option so you don't have to enable anonymous sharing. I got an error with the ExternalUserAndGuestSharing switch since my tenant is set to only allow authenticated external users. Using the switch ExternalUserSharingOnly did the job for the site collection I needed.

That said, oddly it seems to have pushed the change for the tenant and all site collections, as now checking on sites that I know didn't allow new external users do now. They are also site collections that came back showing ExistingExternalUserSharingOnly using PS previously to check the setting. Now they show ExternalUserSharingOnly as a result using the same command:
Get-SPOSite -Identity https://<tenantname>.sharepoint.com/sites/<sitename>| fl

I was also troubleshooting where certain site collections would allow for new external users while others didn't. The commonality seemed to be that sites created from the SharePoint home allowed for it as all settings would indicate in the Admin center GUI. Sites created via MS Teams did not. I even created a new Team to test and sure enough it was set to ExistingExternalUserSharingOnly after being created and I couldn't add new external users. Three hours later I check the same site and now it's set to ExternalUserSharingOnly - it changed!

I know for a fact none of these sites were updated in between the time of running the set PS command on the single site collection and a few hours later. We're okay with this being pushed across all collections but still extremely odd.