SOLVED

Microsoft Teams guest users cant access files

%3CLINGO-SUB%20id%3D%22lingo-sub-2110858%22%20slang%3D%22en-US%22%3EMicrosoft%20Teams%20guest%20users%20cant%20access%20files%3C%2FLINGO-SUB%3E%3CLINGO-BODY%20id%3D%22lingo-body-2110858%22%20slang%3D%22en-US%22%3E%3CP%3EHi%20All.%3C%2FP%3E%3CP%3E%26nbsp%3B%3C%2FP%3E%3CP%3EWe%20have%20%3CSTRONG%3Eenabled%20guest%20users%3C%2FSTRONG%3E%20from%20external%20organization.%3C%2FP%3E%3CP%3EThe%20guest%20users%20can%20access%20a%20Teams.%20But%20%3CSTRONG%3Ethey%20can%E2%80%99t%20view%20files%3C%2FSTRONG%3E%20within%20%3CSTRONG%3EFile%3C%2FSTRONG%3E%20Tab%3C%2FP%3E%3CP%3E%26nbsp%3B%3C%2FP%3E%3COL%3E%3CLI%3ETeams%20Admin%20Centre%20%26gt%3B%26gt%3B%3CSTRONG%3E%20Guest%20Access%3C%2FSTRONG%3E%20is%20turned%20ON.%3CBR%20%2F%3E%3CBR%20%2F%3E%3C%2FLI%3E%3CLI%3E%3CSTRONG%3EM365%20Groups%3C%2FSTRONG%3E%20have%20been%20checked.%3CBR%20%2F%3E%3CBR%20%2F%3E%3CSPAN%20class%3D%22lia-inline-image-display-wrapper%20lia-image-align-inline%22%20image-alt%3D%2200%20M365%20Groups%20both%20Cgecked.png%22%20style%3D%22width%3A%20418px%3B%22%3E%3CIMG%20src%3D%22https%3A%2F%2Ftechcommunity.microsoft.com%2Ft5%2Fimage%2Fserverpage%2Fimage-id%2F251271iB6BE8D9C0FB9F76B%2Fimage-size%2Flarge%3Fv%3D1.0%26amp%3Bpx%3D999%22%20role%3D%22button%22%20title%3D%2200%20M365%20Groups%20both%20Cgecked.png%22%20alt%3D%2200%20M365%20Groups%20both%20Cgecked.png%22%20%2F%3E%3C%2FSPAN%3E%3CBR%20%2F%3E%3CBR%20%2F%3E%3C%2FLI%3E%3CLI%3E%3CSTRONG%3ESPO%20Site%3C%2FSTRONG%3E%20for%20that%20that%20Teams%20has%20following%20settings%3CBR%20%2F%3E%3CBR%20%2F%3E%3CSTRONG%3EIMAGE%3CSPAN%20class%3D%22lia-inline-image-display-wrapper%20lia-image-align-inline%22%20image-alt%3D%2201SPO%20Access.jpg%22%20style%3D%22width%3A%20798px%3B%22%3E%3CIMG%20src%3D%22https%3A%2F%2Ftechcommunity.microsoft.com%2Ft5%2Fimage%2Fserverpage%2Fimage-id%2F251273i90637C0015E39C63%2Fimage-size%2Flarge%3Fv%3D1.0%26amp%3Bpx%3D999%22%20role%3D%22button%22%20title%3D%2201SPO%20Access.jpg%22%20alt%3D%2201SPO%20Access.jpg%22%20%2F%3E%3C%2FSPAN%3E%3C%2FSTRONG%3E%3CBR%20%2F%3E%3CBR%20%2F%3E%3CSTRONG%3ENOTE%3A%20%3C%2FSTRONG%3EThere%20is%20%3CSTRONG%3Eonly%20Blocked%20Domains%3C%2FSTRONG%3E%20and%20not%20additional%20domain%20for%20this%20setting.%26nbsp%3B%3CBR%20%2F%3E%3CBR%20%2F%3E%3C%2FLI%3E%3CLI%3E%3CSTRONG%3ESPO%20sharing%3C%2FSTRONG%3E%20options%20have%20been%20configured%20like%20this%3A%3CBR%20%2F%3E%3CBR%20%2F%3E%26nbsp%3B%3CSPAN%20class%3D%22lia-inline-image-display-wrapper%20lia-image-align-inline%22%20image-alt%3D%2203%20%20SPO%20Sharing%20Access.jpg%22%20style%3D%22width%3A%20999px%3B%22%3E%3CIMG%20src%3D%22https%3A%2F%2Ftechcommunity.microsoft.com%2Ft5%2Fimage%2Fserverpage%2Fimage-id%2F251289i39EC77722A8DC4B2%2Fimage-size%2Flarge%3Fv%3D1.0%26amp%3Bpx%3D999%22%20role%3D%22button%22%20title%3D%2203%20%20SPO%20Sharing%20Access.jpg%22%20alt%3D%2203%20SPO%20Sharing%20Access.jpg%22%20%2F%3E%3C%2FSPAN%3E%3CBR%20%2F%3E%3CBR%20%2F%3E%3CBR%20%2F%3E%3C%2FLI%3E%3CLI%3EUser%20is%20added%20in%20AAD%3CSTRONG%3E%3CBR%20%2F%3E%3CBR%20%2F%3E%3CSPAN%20class%3D%22lia-inline-image-display-wrapper%20lia-image-align-inline%22%20image-alt%3D%2204%20%20AAD%20Accesss.jpg%22%20style%3D%22width%3A%20999px%3B%22%3E%3CIMG%20src%3D%22https%3A%2F%2Ftechcommunity.microsoft.com%2Ft5%2Fimage%2Fserverpage%2Fimage-id%2F251292i7E75A4D191BA26B2%2Fimage-size%2Flarge%3Fv%3D1.0%26amp%3Bpx%3D999%22%20role%3D%22button%22%20title%3D%2204%20%20AAD%20Accesss.jpg%22%20alt%3D%2204%20AAD%20Accesss.jpg%22%20%2F%3E%3C%2FSPAN%3E%3CBR%20%2F%3E%3CBR%20%2F%3E%3C%2FSTRONG%3E%3C%2FLI%3E%3CLI%3EBut%20use%20claims%20he%20access%20Teams%20but%20%3CSTRONG%3ENOT%3C%2FSTRONG%3E%20access%20files%20tab%3CBR%20%2F%3E%3CBR%20%2F%3E%3CSTRONG%3E%3CSPAN%20class%3D%22lia-inline-image-display-wrapper%20lia-image-align-inline%22%20image-alt%3D%2205%20%20Access%20Denied.jpg%22%20style%3D%22width%3A%20999px%3B%22%3E%3CIMG%20src%3D%22https%3A%2F%2Ftechcommunity.microsoft.com%2Ft5%2Fimage%2Fserverpage%2Fimage-id%2F251277i03B8BF8CB5CDCCB3%2Fimage-size%2Flarge%3Fv%3D1.0%26amp%3Bpx%3D999%22%20role%3D%22button%22%20title%3D%2205%20%20Access%20Denied.jpg%22%20alt%3D%2205%20Access%20Denied.jpg%22%20%2F%3E%3C%2FSPAN%3E%3C%2FSTRONG%3E%3CBR%20%2F%3E%3CSTRONG%3EMicrosoft%26nbsp%3Bteams.%26nbsp%3B%20Access%20denied.%26nbsp%3B%20%26nbsp%3BYou%20do%20not%20have%20permission%3CBR%20%2F%3E%3CBR%20%2F%3E%3CBR%20%2F%3E%3C%2FSTRONG%3E%3C%2FLI%3E%3CLI%3EI%20did%20tried%20reproduce%20it%20and%20I%20got%20the%20same%20%3CSTRONG%3EAccess%20denied%20message%3C%2FSTRONG%3E%20in%20%3CU%3E%3CSTRONG%3Eone%20my%20test%20tenants.%26nbsp%3B%3C%2FSTRONG%3E%3C%2FU%3E%3CBR%20%2F%3E%3CBR%20%2F%3E%3C%2FLI%3E%3CLI%3E%26nbsp%3B%20But%20when%20I%20add%20%3CSTRONG%3EAllowed%20domain%20in%20SPO%3C%2FSTRONG%3E%20for%20that%20site%3CBR%20%2F%3E%3CSTRONG%3E%3CSPAN%20class%3D%22lia-inline-image-display-wrapper%20lia-image-align-inline%22%20image-alt%3D%2207%20Adding%20Domain%20in%20SPO.jpg%22%20style%3D%22width%3A%20999px%3B%22%3E%3CIMG%20src%3D%22https%3A%2F%2Ftechcommunity.microsoft.com%2Ft5%2Fimage%2Fserverpage%2Fimage-id%2F251280iB32396CC7FB5A4DC%2Fimage-size%2Flarge%3Fv%3D1.0%26amp%3Bpx%3D999%22%20role%3D%22button%22%20title%3D%2207%20Adding%20Domain%20in%20SPO.jpg%22%20alt%3D%2207%20Adding%20Domain%20in%20SPO.jpg%22%20%2F%3E%3C%2FSPAN%3E%3C%2FSTRONG%3E%3C%2FLI%3E%3CLI%3EThe%20%3CSTRONG%3EGuest%20access%3C%2FSTRONG%3E%20(testing%20with%20my%20outlook.com)%20works.%26nbsp%3B%3CBR%20%2F%3E%3CBR%20%2F%3E%3CSPAN%20class%3D%22lia-inline-image-display-wrapper%20lia-image-align-inline%22%20image-alt%3D%2208%20Guest%20Access%20works.jpg%22%20style%3D%22width%3A%20999px%3B%22%3E%3CIMG%20src%3D%22https%3A%2F%2Ftechcommunity.microsoft.com%2Ft5%2Fimage%2Fserverpage%2Fimage-id%2F251281i3DF8D3B189B7A42D%2Fimage-size%2Flarge%3Fv%3D1.0%26amp%3Bpx%3D999%22%20role%3D%22button%22%20title%3D%2208%20Guest%20Access%20works.jpg%22%20alt%3D%2208%20Guest%20Access%20works.jpg%22%20%2F%3E%3C%2FSPAN%3E%3C%2FLI%3E%3C%2FOL%3E%3CP%3E%3CBR%20%2F%3EIts%26nbsp%3B%20not%20documented%20in%20Microsoft%20Teams%20to%20%3CSTRONG%3Eadd%20domain%20SPO%20Admin%20Centre%20for%20guest%20access%26nbsp%3B%3CBR%20%2F%3E%3C%2FSTRONG%3E%3CA%20href%3D%22https%3A%2F%2Fdocs.microsoft.com%2Fen-us%2Fmicrosoft-365%2Fsolutions%2Fcollaborate-as-team%3Fview%3Do365-worldwide%22%20target%3D%22_blank%22%20rel%3D%22noopener%20noreferrer%22%3Ehttps%3A%2F%2Fdocs.microsoft.com%2Fen-us%2Fmicrosoft-365%2Fsolutions%2Fcollaborate-as-team%3Fview%3Do365-worldwide%3C%2FA%3E%3CBR%20%2F%3E%3CSTRONG%3E%3CBR%20%2F%3E%3C%2FSTRONG%3EPlease%20advice%20what%20I%20am%20is%20missing%20here.%20Thanks%20in%20advance.%3CBR%20%2F%3E%3CBR%20%2F%3E%3CA%20href%3D%22https%3A%2F%2Ftechcommunity.microsoft.com%2Ft5%2Fuser%2Fviewprofilepage%2Fuser-id%2F72542%22%20target%3D%22_blank%22%3E%40adam%20deltinger%3C%2FA%3E%26nbsp%3B%26nbsp%3B%3CA%20href%3D%22https%3A%2F%2Ftechcommunity.microsoft.com%2Ft5%2Fuser%2Fviewprofilepage%2Fuser-id%2F169605%22%20target%3D%22_blank%22%3E%40Christopher%20Hoard%3C%2FA%3E%26nbsp%3B%26nbsp%3B%3CA%20href%3D%22https%3A%2F%2Ftechcommunity.microsoft.com%2Ft5%2Fuser%2Fviewprofilepage%2Fuser-id%2F869%22%20target%3D%22_blank%22%3E%40Chris%20Webb%3C%2FA%3E%26nbsp%3B%3CSTRONG%3E%3CBR%20%2F%3E%3CBR%20%2F%3E%3CBR%20%2F%3E%3C%2FSTRONG%3E%3C%2FP%3E%3C%2FLINGO-BODY%3E%3CLINGO-LABS%20id%3D%22lingo-labs-2110858%22%20slang%3D%22en-US%22%3E%3CLINGO-LABEL%3EAdministrator%3C%2FLINGO-LABEL%3E%3CLINGO-LABEL%3Ebest%20practices%3C%2FLINGO-LABEL%3E%3CLINGO-LABEL%3ESettings%3C%2FLINGO-LABEL%3E%3CLINGO-LABEL%3ETips%20%26amp%3B%20Tricks%3C%2FLINGO-LABEL%3E%3C%2FLINGO-LABS%3E%3CLINGO-SUB%20id%3D%22lingo-sub-2114931%22%20slang%3D%22en-US%22%3ERe%3A%20Microsoft%20Teams%20guest%20users%20cant%20access%20files%3C%2FLINGO-SUB%3E%3CLINGO-BODY%20id%3D%22lingo-body-2114931%22%20slang%3D%22en-US%22%3E%3CP%3E%3CA%20href%3D%22https%3A%2F%2Ftechcommunity.microsoft.com%2Ft5%2Fuser%2Fviewprofilepage%2Fuser-id%2F551905%22%20target%3D%22_blank%22%3E%40ChristianBergstrom%3C%2FA%3E%26nbsp%3B%20Thanks%20for%20your%20valuable%20inputs.%20With%20%22New%20and%20existing%20guests%22%20SPO%20Sharing%20options%20it%20worked.%20Thanks%20again!%3C%2FP%3E%3C%2FLINGO-BODY%3E%3CLINGO-SUB%20id%3D%22lingo-sub-2110949%22%20slang%3D%22en-US%22%3ERe%3A%20Microsoft%20Teams%20guest%20users%20cant%20access%20files%3C%2FLINGO-SUB%3E%3CLINGO-BODY%20id%3D%22lingo-body-2110949%22%20slang%3D%22en-US%22%3E%3CP%3E%3CA%20href%3D%22https%3A%2F%2Ftechcommunity.microsoft.com%2Ft5%2Fuser%2Fviewprofilepage%2Fuser-id%2F43548%22%20target%3D%22_blank%22%3E%40Aroh%20Shukla%3C%2FA%3E%26nbsp%3BHi%2C%20just%20one%20thing%20I%20noticed.%20Sure%20you%20want%20to%20use%20%22Existing%20guests%20only%22%20in%20the%26nbsp%3BSharePoint%20site-level%20sharing%20settings%20and%20not%20%22New%20and%20existing%20guests%22%3F%20You%20have%20already%20added%20all%20guests%20that%20are%20going%20to%20collaborate%3F%3C%2FP%3E%3CP%3E%26nbsp%3B%3C%2FP%3E%3CP%3EJust%20to%20be%20clear.%20I%20mean%20you%20cannot%20use%20that%20option%20and%20after%20the%20configuration%20is%20set%20add%20guests.%20They%20have%20to%20be%20in%20the%20org.%20already%20using%20that%20setting.%3C%2FP%3E%3C%2FLINGO-BODY%3E
Frequent Contributor

Hi All.

 

We have enabled guest users from external organization.

The guest users can access a Teams. But they can’t view files within File Tab

 

  1. Teams Admin Centre >> Guest Access is turned ON.

  2. M365 Groups have been checked.

    00 M365 Groups both Cgecked.png

  3. SPO Site for that that Teams has following settings

    IMAGE01SPO Access.jpg

    NOTE: There is only Blocked Domains and not additional domain for this setting. 

  4. SPO sharing options have been configured like this:

     03  SPO Sharing Access.jpg


  5. User is added in AAD

    04  AAD Accesss.jpg

  6. But use claims he access Teams but NOT access files tab

    05  Access Denied.jpg
    Microsoft teams.  Access denied.   You do not have permission


  7. I did tried reproduce it and I got the same Access denied message in one my test tenants. 

  8.   But when I add Allowed domain in SPO for that site
    07 Adding Domain in SPO.jpg
  9. The Guest access (testing with my outlook.com) works. 

    08 Guest Access works.jpg


Its  not documented in Microsoft Teams to add domain SPO Admin Centre for guest access 
https://docs.microsoft.com/en-us/microsoft-365/solutions/collaborate-as-team?view=o365-worldwide

Please advice what I am is missing here. Thanks in advance.

@adam deltinger  @Christopher Hoard  @Chris Webb 


2 Replies
best response confirmed by Aroh Shukla (Frequent Contributor)
Solution

@Aroh Shukla Hi, just one thing I noticed. Sure you want to use "Existing guests only" in the SharePoint site-level sharing settings and not "New and existing guests"? You have already added all guests that are going to collaborate?

 

Just to be clear. I mean you cannot use that option and after the configuration is set add guests. They have to be in the org. already using that setting.

@ChristianBergstrom  Thanks for your valuable inputs. With "New and existing guests" SPO Sharing options it worked. Thanks again!