Forum Discussion

Bejhan's avatar
Bejhan
Copper Contributor
Jul 23, 2026

Best practices: Open OneDrive/SharePoint sharing but restrict Teams guest access by domain

Hi all,

Since SharePoint Online and OneDrive moved fully to Microsoft Entra B2B for external sharing, we've run into a policy conflict and would like to hear how others are handling it.

Our requirements

  • Enable OneDrive and SharePoint file sharing with external users, regardless of their email domain.

  • Restrict Microsoft Teams guest access to a predefined list of approved partner domains.

  • Continue allowing Teams external access (federated chat and meetings) for all domains.

The problem:

  • Teams guests, SharePoint guests, and OneDrive guests are now governed by the same Microsoft Entra B2B invitation framework and the single Collaboration restrictions allow/deny list under:
    External Identities → External collaboration settings
  • As a result, restricting guest invitations by domain also restricts OneDrive and SharePoint sharing for domains not on the allowlist.
  • According to Microsoft's response in the following Q&A, this behavior is currently by design: https://learn.microsoft.com/en-us/answers/questions/5954975/onedrive-external-sharing-no-longer-working-with-a

Questions to the community

  1. Has anyone implemented a solution where OneDrive/SharePoint sharing remains open to all domains while Teams guest access is restricted to approved domains only?

     

  2. Are there recommended approaches using Entitlement Management, Access Packages, Connected Organizations, or other Entra capabilities?

     

  3. Is there any roadmap item for workload-specific collaboration restrictions (e.g., separate policies for Teams guest invitations and SharePoint/OneDrive sharing)?

Any real-world experience or best practices would be greatly appreciated.

Thanks,

Bejhan

Azure Active Directory (AAD)
Azure AD B2B
Azure AD B2C
microsoft entra

6 Replies

  • yhl's avatar
    yhl
    MCT
    Jul 23, 2026

    What you really need to do is to control Entra B2B guest invitation. 

    Teams ad-hoc chat/meeting - does not require B2B account creation

    Sharepoints OTP ad-hoc based sharing - does not require B2B account creation, but this is in the process of being deprecated

    Teams "guest access" to internal teams and collaboration - this requires B2B guest invitation

     

    So, you just have to control who can invite B2B guests and that essentially controls which B2B guest can be added to internal Teams.  The only gotcha you need to review with user is if they're actually using SharePoints OTP ad-hoc sharing or more B2B guest user based sharing.

    • Bejhan's avatar
      Bejhan
      Copper Contributor
      Jul 24, 2026

      Hi yhl​ 

      Thanks for your input.

      I agree that controlling who can invite Entra B2B guests is an important part of the solution. However, our challenge is slightly different.

       

      Historically, we relied on SharePoint/OneDrive OTP-based sharing as well. The issue we are seeing now is that Microsoft confirmed that when"Allow invitations only to the specified domains" is configured in Entra B2B Collaboration Restrictions, OneDrive and SharePoint sharing invitations are evaluated against the same Entra B2B framework and are therefore blocked for domains outside the allowlist.

       

      Our goal is to achieve all of the following simultaneously:

      • Allow OneDrive and SharePoint file sharing with external users from any domain
      • Allow Teams external chat and meetings with users from any domain
      • Restrict Entra B2B guest accounts that can be added to Teams to approved domains only

      Based on Microsoft's response, there currently does not seem to be a supported way to apply domain restrictions only to Teams guest scenarios while allowing SharePoint and OneDrive invitations to bypass the same Entra B2B restrictions. SharePoint guests, OneDrive guests, and Teams guests now appear to rely on the same underlying Entra B2B invitation framework.
      https://learn.microsoft.com/en-us/answers/questions/5954975/onedrive-external-sharing-no-longer-working-with-a

       

      So unless I'm missing something, controlling who can invite B2B guests alone would not solve the problem, because the domain allowlist itself is what prevents OneDrive and SharePoint sharing to external users outside the approved domains.

       

      Have you seen a configuration where OneDrive/SharePoint sharing remains open to any domain, while Entra B2B guest creation is restricted to a defined set of domains?

      Thanks!

      • yhl's avatar
        yhl
        MCT
        Jul 27, 2026

        Effectively, as Microsoft move toward having as many services using same B2B system for all external sharing, you will not be able to restrict one but not the other.

        As that Q&A answered, you will have to implement control in other layers to try to achieve this, 

        1. such as separate system/tenant dedicated for external sharing on sharepoint, and no personal onedrive sharing to external users; this isn't uncommon in many enterprise situations
        2. have broader domain whitelist and allow the person inviting in to make the ultimate decision if the invitation shall be granted; but once in, they're IN.

         

         

    • Bejhan's avatar
      Bejhan
      Copper Contributor
      Jul 23, 2026

      Hi yhl​,

      Thank you for your reply.

      I think this is exactly where our challenge comes from. Historically, we also relied on OTP-based sharing and treated SharePoint/OneDrive sharing separately from Entra B2B guests.

      However, Microsoft recently confirmed that when Collaboration Restrictions are configured as "Allow invitations only to the specified domains", OneDrive and SharePoint sharing to external users outside the allowlist is blocked as well, as these scenarios now use the same Entra B2B invitation framework.

      (Reference: Answer from "Liora D" in https://learn.microsoft.com/en-us/answers/questions/5954975/onedrive-external-sharing-no-longer-working-with-a)

      Because of this, we're no longer looking for a way to control who can invite guests, but rather for a way to achieve the following at the same time:

      • Allow OneDrive and SharePoint sharing with users from any domain.
      • Allow Teams external chat and meetings with users from any domain.
      • Restrict Entra B2B guest accounts that can be added to Teams to approved domains only.

       

      At the moment, it seems that restricting Collaboration Restrictions also restricts SharePoint and OneDrive sharing, which is exactly what we are trying to avoid.

    • Bejhan's avatar
      Bejhan
      Copper Contributor
      Jul 23, 2026

      Hi ​ VasilMichev​,

      The challenge is that using Teams External Access domain restrictions would also restrict our federated Teams chat and meeting scenarios, which we would like to keep open for all external domains.

      Our goal is specifically:

      • Allow OneDrive and SharePoint sharing with external users from any domain
      • Allow Teams external chat and meetings with users from any domain
      • Restrict only Microsoft Entra B2B guest accounts that can be added to Teams to a defined list of approved domains

      As far as I understand, Teams External Access policies would impact both chat and meeting federation, not just guest access.

      Have you seen a way to restrict Entra B2B guests used for Teams guest access while keeping external chat, meetings, and OneDrive/SharePoint sharing open for all domains?

      Thanks!