Ive seen some similar posts and done al ot of research but am as yet unable to ascertain if there is a way to do this , so Im posting the question in case im missing something.
We are a large org, with circa 40000 M365 users (basically staff and students) and currently have external sharing set to be only allowed by domain whitelist (sharepoint top level Allow list). Students have only recently been onboarded (same tenant but with subdomain) and the we want to allow them to share unrestricted via onedrive but maintain restrictions for staff (control via domain whitelist).
My current understanding is that there seems to be no way to have top level sharepoint setting of restrict by domain and then have anything lower than that less restrictive - i.e. onedrive cannot be less restrictive. So the approach would have to be allow globally at top level SP setting which the students would inherit, and then individually apply more restrictive settings for the staff on a per user basis.
I can see how the above would technically work but the reality is that is unmanageable for 1000s of users when the settings seem to be applied using powershell Set-SPOSite cmdlet on a individual user basis and I cant see it that is possible to control at a Security Group level or even with batch processing, additionally we will be adding / removing whitelist domains quite frequently so the settings would have to be applied on a daily basis.
Ive looked at Information Barriers for Teams for similar segregation reasons but not looked at IB for sharepoint & onedrive in depth yet (will read some more today if I get a chance) , but with a quick glance I cant see how those can be used for controlling external sharing anyway so I dont think it will be a solution.
Any further suggestions or ideas are appreciated - open to any ideas, licencing not likely to be an issue given we have E5 level. Utilizing scripted solutions , Azure Automation etc all perfectly acceptable if can be applied within in reasonable timeframe each day.
This seems to be a (another) big blind spot for use cases for large organizations - seems crazy to assume that when you are dealing with 10s of thousands of users that you wouldn't need more flexibility in an easier to administer way.
