Issue sharing wih external users in OneDrive

[Deleted]

Has anyone else come across this scenario where a user is unable to share with external contacts? The error says that you "cannot share a secure link containing both people inside and outside of your organization".

After investigating it seems that in this case one of the external users is auto-added as a guest in Azure AD (presumably because their company use O365 too), and is now treating them as an internal user. This makes sense to me but won't make sense to our users... just because they have been auto-added to Azure AD, doesn't make them 'internal users'.

See attached example - look forward to people's thoughts?

[#2]

External 365 users won't be treated as internal, or they shouldn't be. That is odd, you sure someone just didn't create the user to have an account in your tenant using the external e-mail address associated with the user record? If you search for the user in portal.azure.com in active directory what comes up? what type of user?

[#3]

>After investigating it seems that in this case one of the external users is auto-added as a guest in Azure AD (presumably because their company use O365 too)

This is normal and they have to have at least regular MS account (not only O365) to become guests. They still are labeled as guests in Azure AD and they are not treated as internal users. The error you receive is odd. Maybe you somehow picked 2 options while sharing, although this shouldn't be possible. You can try removing all sharing and sharing again. A file can only be shared as a not secure anonymous link or with the authentication (secure) - either to only internal users or to anyone with MS account.

[#4]

Thanks Christopher for your message. Yes definitely sure it isn't an internal account which we have created. When searching in Azure AD it appears a guest. This to me suggests we do have an issue of some sort within our tenant. Thanks for your help.

[#5]

Why do you think you have a problem? If you have guests, then guest access is enabled in your tenant. So you might want to disable it and then remove guests users, if your tenant should only work with internal users. But if you want to share files with other organizations and also require for them to authenticate and be able to edit files (not just share as anonymous read only link), then you have to have guest access enabled. 

[#6]

The issue isn't that we have guest users in AAD - we frequently share files with external contacts requiring authentication (usually via OneDrive). The problem is they are appearing as 'internal' from the end user's perspective/when they go to share files.

See example from my initial post: https://techcommunity.microsoft.com/t5/OneDrive-for-Business/Issue-sharing-wih-external-users-in-One...

In this example these are both external to the company, however OneDrive is seeing one of them as 'internal' (the one that's in AAD).

[#7]

This is weird. If i try to add both guests users to sharing dialog as specific people or just one guest and one internal, i get a message that they are outside of my organization. I don't see warning shown to you and i can't find a setting that might cause it.

[#8]

Hi all,

I have a hypothesis on what's happening here and hopefully you can give this a try and let me know if it makes sense. Today, you can't create a Specific People link that is supposed to work for both internal and external users. Under the covers, my hypothesis is that the issue here is really that you are entering 1 user who is present in AAD and 1 user who is not.

Can you try creating a link for specific people where both people are new external users (i.e. not in your directory)? And if that works, also try creating a specific people link where both people are existing external users in your directory.

If both of these work, I think its expected but the error message is probably wrong. Thanks!

Stephen Rice

OneDrive Program Manager II

[#9]

We'll see what results Alex will have. In my case no matter what variant i try i only get an informational message that some users listed are not in my organization (no matter if already existing guest user or if i put some fictional email address in). I can't make it show me same error as Alex has (in his first message in attachment). And the error he gets is confusing, as there shouldn't be difference whom you are sharing a link with or if you mix guests and internal users in the same link.

[#10]

We have encountered this issue in our tenant too. It seems that once the user is added to the Azure AD as a Guest SP treats the user as a internal user and any future sharing links that include said user along with another external user not added to the tenant Azure AD generate the error OP mentioned.

Would like to know if anybody understands why the user is treated as a internal user once he is added to the Azure AD.