Sharing files with authenticated external users

[James Breton]

Hi, I'm looking into how to share files from SharePoint and/or OneDrive (Office 365 EMS E3 account) with authenticated external users.  In this case the user has a Gmail account, but ideally would like to be able to arbitrarily "trust" certain domains to handle authentication in the remote IdP so that there's no additional work for the 3rd party user to do as long as they are signed into their 3rd party account.

From this article and the others in the series: https://alpeshnakar.com/invite-external-user-to-office-365-via-sharepoint-online/

It looks like this is possible as long as the user has a Google business account.  If so, is there any more configuration for me to do on the AAD side, or does AAD implicitly trust Google as an authentication service?  Furthermore, what if I wanted to trust some other 3rd party authenticator (IdP), such as an organization who used Okta, or iCloud, or some other cloud IdP?  There has to be some way to tell AAD which IdPs to trust and for which domains, but I can't find it anyplace.  Is there such a thing, or does AAD only trust the big IdPs and you can't change it?

Thanks.

[#2]

Here are couple of links which can be of some help

https://answers.microsoft.com/en-us/msoffice/forum/msoffice_onedrivefb/not-able-to-share-organizatio...

https://docs.microsoft.com/en-us/azure/active-directory/active-directory-saas-google-apps-tutorial

[#3]

Hi, thank you for the response -- however that's not quite what I'm looking for. One of those articles states "external user should own Microsoft account (such as Outlook.com or Live.com) or Office 365 account for sign-in process at least. For the gmail or yahoo users, as a workaround, you can consider signing up a Microsoft account with the gmail or yahoo email address" -- which means the intended guest user still needs to create himself a Microsoft account. The other article discusses using your AAD identity to sign into Google services, which is the opposite of what I'm trying to do -- have a Google user sign into our AAD tenant.

I'm looking for a way for our AAD tenant to trust Google authentication to validate the user's identity, much the way SAML SSO services trust MS AAD identity assertions. In other words, I want the incoming guest user to provide an assertion that states "Google have verified my identity as joeuser@gmail.com," and then we trust that assertion.

All of this is technically possible at a fundamental level, I just don't know how to make it work with AAD -- unless you just can't do this because the interface to configure it isn't implemented.