Forum Discussion

James Breton's avatar
James Breton
Copper Contributor
Mar 07, 2018

Sharing files with authenticated external users

Hi, I'm looking into how to share files from SharePoint and/or OneDrive (Office 365 EMS E3 account) with authenticated external users.  In this case the user has a Gmail account, but ideally would like to be able to arbitrarily "trust" certain domains to handle authentication in the remote IdP so that there's no additional work for the 3rd party user to do as long as they are signed into their 3rd party account.

 

From this article and the others in the series: https://alpeshnakar.com/invite-external-user-to-office-365-via-sharepoint-online/

 

It looks like this is possible as long as the user has a Google business account.  If so, is there any more configuration for me to do on the AAD side, or does AAD implicitly trust Google as an authentication service?  Furthermore, what if I wanted to trust some other 3rd party authenticator (IdP), such as an organization who used Okta, or iCloud, or some other cloud IdP?  There has to be some way to tell AAD which IdPs to trust and for which domains, but I can't find it anyplace.  Is there such a thing, or does AAD only trust the big IdPs and you can't change it?

 

Thanks.

Azure Active Directory
    • James Breton's avatar
      James Breton
      Copper Contributor
      Mar 07, 2018
      Hi, thank you for the response -- however that's not quite what I'm looking for. One of those articles states "external user should own Microsoft account (such as Outlook.com or Live.com) or Office 365 account for sign-in process at least. For the gmail or yahoo users, as a workaround, you can consider signing up a Microsoft account with the gmail or yahoo email address" -- which means the intended guest user still needs to create himself a Microsoft account. The other article discusses using your AAD identity to sign into Google services, which is the opposite of what I'm trying to do -- have a Google user sign into our AAD tenant.

      I'm looking for a way for our AAD tenant to trust Google authentication to validate the user's identity, much the way SAML SSO services trust MS AAD identity assertions. In other words, I want the incoming guest user to provide an assertion that states "Google have verified my identity as joeuser@gmail.com," and then we trust that assertion.

      All of this is technically possible at a fundamental level, I just don't know how to make it work with AAD -- unless you just can't do this because the interface to configure it isn't implemented.

Resources