SharePoint Guests vs Azure AD Guests

[Maxwell Shifman]

I'm trying to understand the use of SharePoint Online Guests and the integration with Azure AD.

We use External Sharing via SharePoint/OneDrive for Business extensively, with the default being to Specific People with email address enforcement. At the moment, I can keep track of all Accounts that have ever been shared to at https://tenant.sharepoint.com/_layouts/15/people.aspx?MembershipGroupId=0.

We do not require manually adding Guest users to our Azure AD, and it is not our practice. Yet, when I go to Azure AD management (https://portal.azure.com/#blade/Microsoft_AAD_IAM/UsersManagementMenuBlade/AllUsers), a subset (maybe 50%) of the external users that have been shared to via SharePoint are also shown as Guests in our Azure AD.

What I want to know is:

1. What is the trigger for an external user to be added automatically as a Guest to our Azure AD?
2. Do I need to keep users in our Azure AD as Guests if we are only sharing links via SharePoint?
3. Is there any additional benefit in ensuring external users are added as Guests in Azure AD?

[#2]

I subsequently found the blog post which explains the new Sharing Experience (https://techcommunity.microsoft.com/t5/SharePoint-Support-Blog/Coaching-your-guest-users-through-the...).

Does this mean we can delete unneeded users from Azure AD and not lose their ability to access their existing links?

[#3]

When you share a SPO Site with an external user he should be added also as external user in your Azure AD. Basically Azure AD is the hub that centrally manages how users (external and no external) can access to Office 365 services. Behind the scenes SPO and EXO have their own AD implementation that is bidirectionally synchronized with Azure AD so if an account is added to Azure AD, is going to be propaggated to SPO and the other way around

[#4]

Hi @Maxwell Shifman ,

Hopefully I can shed some light here :) 

At the moment, when you share to an entirely new person (i.e. never been shared to before) from ODB and share via the "specific people" option, one of two things can happen. If the recipient is an O365 user, when they redeem the link, they will be added to your directory as a full guest user (note that there are some cases where this may not occur). If they are not an O365 user, they are only instantiated on that site collection (or OneDrive).

This will all change in a few months when we fully migrate over to Azure B2B as the backing guest account service for ODB/SPO (as announced/demo'd at Ignite). Once done, all new shares will result in guest accounts being created.

The biggest difference between guest account created/not created is how you apply management & policy to those users.

Hope that helps!

Stephen Rice

OneDrive Program Manager II

[#5]

Hi @Stephen Rice 

Could you please update whether currently, every share creates a guest user in AAD? 

Thanks

[#6]

Hi @roniy,

As of this moment, the answer is no, every share (from OneDrive or SharePoint) does not create a guest user. Some do (as discussed above) but the Azure B2B integration I mentioned previously is still opt-in at the moment. Hope that helps!

Stephen Rice

Senior Program Manager, OneDrive

[#7]

Thank you @Stephen Rice for the quick reply.

I would like to understand exactly in which cases a guest user is created. Is there any documentation about this you can point me to? 

[#8]

Hi @roniy,

The closest we have is this: https://docs.microsoft.com/en-us/sharepoint/what-s-new-in-sharing-in-targeted-release

Hope that helps!

Stephen Rice

Senior Program Manager, OneDrive

[#9]

Thank you @Stephen Rice!

Last question: is there a difference between sharing a site and sharing a file/folder in this regard? 

[#10]

Hi @roniy,

Do you mean for the expiration feature? There is no difference for this feature. 

Going a little more technical: Each site/OneDrive has an object called the User Info Table which stores information about the users who have access to content (regardless of whether they were added to the entire site or to a single file or folder). This expiration feature adds an expiration date to that user's entry in the User Info Table so that when they expire, they lose access. 

Hope that helps!

Stephen Rice

EDIT FOR POSTERITY: This probably belonged in a different thread and isn't directly related to this subject matter :)

[#11]

@Stephen Rice 

That's helpful, thanks! 

Actually I was asking about the creation of guest users in AAD - is there a difference between sharing a site and sharing a file/folder? 

I commented on a few different threads so sorry for the confusion :)

[#12]

@roniy,

Ha! You are totally right! My mistake :)

To answer your actual question, yes, there are differences between file/folder sharing and site sharing (especially when Azure B2B integration is disabled). Site sharing requires account creation (either AAD or MSA) while file/folder sharing go through the One Time Passcode flow (which doesn't always result in account creation).

Once Azure B2B is enabled, both file/folder sharing and site sharing go through the same B2B flow which results in guest account creation :) 

Hopefully this answers your actual question this time! :D

Stephen

[#13]

Hi @Stephen Rice , I have a related question:

 Can external users (not in AAD) be added to SharePoint groups?

[#14]

@Stephen Rice Just wondering about the "Azure B2B as the backing guest account service for ODB/SPO"? Are all tenants now using the new way of sharing?

[#15]

@Jonas Back, the short answer is "it's complicated, but getting less so" :)

All new tenants as of June 2023 have Entra B2B Integration with SPO on by default. All guest sharing will go through B2B as a result.

For existing tenants, they can opt into using B2B in all cases if desired. Otherwise file/folder sharing will use B2B accounts (if the guest already exists) or SharePoint one time passcode (if they do not). Sharing a site with a guest will always use B2B. There are a few other minor edge cases that use the legacy SharePoint Invitation Manager but we are working on deprecating those.

Hopefully this all makes sense but let me know if you have any questions!

Stephen Rice

Principal Product Manager, OneDrive

[#16]

@Stephen Rice It's mainly the scenario when sharing a file/folder (if user that does not exist) I'm wondering about - any timeline when this will default to B2B rather than SharePoint OTP?

[#17]

@Jonas Back nothing to share as of yet. Directionally, this is where we are going but will take us time to get there. As we start moving there, you can expect to see a Message Center post with the plan and timelines (with plenty of time for organizations to prepare!). Thanks!

Stephen Rice

Principal Product Manager, OneDrive