02-12-2019 06:14 PM
I'm trying to understand the use of SharePoint Online Guests and the integration with Azure AD.
We use External Sharing via SharePoint/OneDrive for Business extensively, with the default being to Specific People with email address enforcement. At the moment, I can keep track of all Accounts that have ever been shared to at https://tenant.sharepoint.com/_layouts/15/people.aspx?MembershipGroupId=0.
We do not require manually adding Guest users to our Azure AD, and it is not our practice. Yet, when I go to Azure AD management (https://portal.azure.com/#blade/Microsoft_AAD_IAM/UsersManagementMenuBlade/AllUsers), a subset (maybe 50%) of the external users that have been shared to via SharePoint are also shown as Guests in our Azure AD.
What I want to know is:
02-12-2019 06:22 PM
02-12-2019 10:34 PM
02-19-2019 09:53 AM
Hi @Maxwell Shifman ,
Hopefully I can shed some light here :)
At the moment, when you share to an entirely new person (i.e. never been shared to before) from ODB and share via the "specific people" option, one of two things can happen. If the recipient is an O365 user, when they redeem the link, they will be added to your directory as a full guest user (note that there are some cases where this may not occur). If they are not an O365 user, they are only instantiated on that site collection (or OneDrive).
This will all change in a few months when we fully migrate over to Azure B2B as the backing guest account service for ODB/SPO (as announced/demo'd at Ignite). Once done, all new shares will result in guest accounts being created.
The biggest difference between guest account created/not created is how you apply management & policy to those users.
Hope that helps!
Stephen Rice
OneDrive Program Manager II
07-05-2020 07:13 AM
Could you please update whether currently, every share creates a guest user in AAD?
Thanks
07-06-2020 09:08 AM
Hi @roniy,
As of this moment, the answer is no, every share (from OneDrive or SharePoint) does not create a guest user. Some do (as discussed above) but the Azure B2B integration I mentioned previously is still opt-in at the moment. Hope that helps!
Stephen Rice
Senior Program Manager, OneDrive
07-06-2020 11:34 PM
Thank you @Stephen Rice for the quick reply.
I would like to understand exactly in which cases a guest user is created. Is there any documentation about this you can point me to?
07-07-2020 02:28 PM
Hi @roniy,
The closest we have is this: https://docs.microsoft.com/en-us/sharepoint/what-s-new-in-sharing-in-targeted-release
Hope that helps!
Stephen Rice
Senior Program Manager, OneDrive
07-08-2020 09:45 AM
Thank you @Stephen Rice!
Last question: is there a difference between sharing a site and sharing a file/folder in this regard?
07-08-2020 10:56 AM - edited 07-08-2020 12:02 PM
Hi @roniy,
Do you mean for the expiration feature? There is no difference for this feature.
Going a little more technical: Each site/OneDrive has an object called the User Info Table which stores information about the users who have access to content (regardless of whether they were added to the entire site or to a single file or folder). This expiration feature adds an expiration date to that user's entry in the User Info Table so that when they expire, they lose access.
Hope that helps!
Stephen Rice
EDIT FOR POSTERITY: This probably belonged in a different thread and isn't directly related to this subject matter :)
07-08-2020 11:43 AM
That's helpful, thanks!
Actually I was asking about the creation of guest users in AAD - is there a difference between sharing a site and sharing a file/folder?
I commented on a few different threads so sorry for the confusion :)
07-08-2020 12:05 PM
Ha! You are totally right! My mistake :)
To answer your actual question, yes, there are differences between file/folder sharing and site sharing (especially when Azure B2B integration is disabled). Site sharing requires account creation (either AAD or MSA) while file/folder sharing go through the One Time Passcode flow (which doesn't always result in account creation).
Once Azure B2B is enabled, both file/folder sharing and site sharing go through the same B2B flow which results in guest account creation :)
Hopefully this answers your actual question this time! :D
Stephen
09-03-2020 08:08 AM
Hi @Stephen Rice , I have a related question:
Can external users (not in AAD) be added to SharePoint groups?