Need Advice for specific SharePoint site configuration

[April_Gutierrez]

I have been asked to set up a single SharePoint site with the following requirements.

The site has a single document library with two main folders: External and Internal.

• External is for files that will be used by internal staff and some files that will be shared with external users (who may or may not have a Microsoft account)
• Management would like to manage the external users via a SharePoint group. This group would have permission to download and upload, but not to edit files in SP itself. Further, these users should be the only external users with access to the site.
• I have created the group and added it to the External folder. I then added an external user and shared a sub-folder with them. Two things happened:
  • the user was asked to log into a Microsoft account
  • the user could still edit files in the sub-folder
• I was also able to invite other external users, who obviously didn't inherit the SP group permissions

• Internal is for internal staff (members of our tenant) use. The requirement here is to prevent them from sharing files in this directory with external users. I know this is possible if I move the files to their own SP site, but management preference is to keep the two directories in a single site.

Is it possible to implement any or all of the above?

Thank you in advance.

[#2]

The First question that came to my mind to better understand what you are doing and what possibly can go wrong is, what kind of user is your „external user“. Is it a guest user you invited to the group of the Site or is it a normal user of your tenant you gave a license and handed over to an external Partner?

[#3]

@Andre Radtke These users are not currently part of our tenant. Would we need to invite them as guests before adding them to a sharepoint group?

[#4]

Yes, in general you must invite them to your tenant (https://learn.microsoft.com/en-us/microsoft-365/community/managing-external-guest-in-sharepoint-vs-t...), then create a group as you already did as it seems and then, this is my advice, just put the external users into this group and create a custom permission level to meet your requirements but I guess view only might be enought. If the guest users are in the group (standard group) of a group connected site, then they might have too much rights onto the site, pls check that.