Week 4, Day 3 — External Sharing Controls & Guest Access

Day 2 review & the external sharing gap

• Ask: "You broke inheritance on Payroll Records and restricted access to Priya Nair and Sarah Chen. Can someone outside Lakeview Logistics still access a Payroll Records document?" — answer: yes, if they are sent a sharing link or granted guest access. Internal permissions don't control external access.
• Ask: "What is the default external sharing setting for a new SharePoint Online tenant?" — answer: Anyone (anonymous links). This is frequently surprising and almost always wrong for a business environment.
• Frame the day: external sharing is where the most significant accidental data exposure happens in SharePoint Online. The internal permissions model from Day 2 means nothing if an employee sends an anonymous link to a document containing payroll data. Today's controls close that gap.

External sharing tiers, tenant vs site settings, and guest governance

External sharing in SharePoint Online has a layered control model — tenant-level settings set the ceiling, site-level settings can only be equal to or more restrictive than the tenant. Both must be understood to configure sharing correctly.

The four sharing tiers — most to least permissive

• Tenant vs site level — the ceiling model — the tenant-level sharing setting sets the maximum permitted sharing across all sites. Individual sites can only be set to the same level or more restrictive — never more permissive. If the tenant is set to "New and existing guests", a site cannot be set to "Anyone" even if an admin tries. This means tightening the tenant setting immediately restricts all sites.
• Domain restrictions — allow and block lists — at the tenant level, admins can maintain an allow list (only these domains can be shared with) or a block list (these domains can never be shared with). Useful for restricting sharing to known partners. Only one list can be active at a time — allow list or block list, not both.
• Link expiry and permission scope — "Anyone" links can be configured with a mandatory expiry (e.g. 30 days) and can be scoped to View-only or Edit. Even if "Anyone" links are enabled at the tenant, expiry makes them less risky. View-only scope prevents download in the browser (though not via direct URL).
• Guest access governance — when a guest is invited, an Entra ID B2B guest account is created. Guest accounts can be reviewed and managed in Entra ID. Key settings: guest user access restrictions (what guests can see in the directory), guest invite settings (who can invite guests), and guest access reviews (periodic confirmation that guest access is still needed).
• Recommended settings for Lakeview Logistics — a logistics company with regulated clients needs a balanced posture: tenant set to "New and existing guests" (allows client collaboration), Finance and HR sites set to "Only people in your organisation" (no external access to sensitive data), domain allow list restricted to known client domains, and mandatory 30-day expiry on all external links.

Lab 4-C: Configuring external sharing controls for Lakeview Logistics

Students tighten the tenant-level sharing setting, configure site-level overrides for sensitive departments, set link expiry and domain restrictions, invite a guest user and examine the resulting Entra ID guest account, and verify the configuration in PowerShell.

• Step 1 — Record the default tenant sharing setting (5 min)
  SharePoint admin centre → Policies → Sharing. Note the current setting for SharePoint and OneDrive (likely "Anyone" or "New and existing guests"). Record before making any changes.
• Step 2 — Set the tenant-level sharing policy (10 min)
  In Policies → Sharing, configure:
  · SharePoint: New and existing guests
  · OneDrive: New and existing guests
  · "Anyone" links: Must expire within 30 days
  · People who use a verification code must re-verify after: 15 days
  · Default link type: Specific people (not Anyone)
  · Default link permission: View
  Save. Record all settings.
• Step 3 — Set site-level sharing for Finance and HR (10 min)
  In the SharePoint admin centre → Active sites. Click the Finance Department site → Sharing tab in the right panel → set to Only people in your organisation. Save.
  
  Repeat for the HR Department site. These two sites now have no external sharing regardless of tenant setting.
• Step 4 — Configure a domain allow list (10 min)
  Back in Policies → Sharing → More external sharing settings → Limit external sharing by domain. Enable. Select Allow only specific domains. Add: contoso.com (simulating a known Lakeview Logistics client). Save.
  
  In your Lab Journal: what happens if a user tries to share a document with someone at gmail.com after this restriction is in place?
• Step 5 — Invite a guest user and examine the Entra ID account (15 min)
  Navigate to the Sales Department SharePoint site → Share site → invite an external email address (use a personal email you have access to) as a guest with Read access.
  
  After the invite is sent, navigate to entra.microsoft.com → Users → All users. Filter by User type: Guest. Locate the newly created guest account. Record: display name, UPN format, user type, and invited by.
• Step 6 — Verify sharing settings via PowerShell (10 min)
  Connect to SharePoint Online PowerShell. Run:
  Get-SPOTenant | Select-Object SharingCapability, DefaultSharingLinkType, DefaultLinkPermission, RequireAnonymousLinksExpireInDays | Format-List
  
  Then check site-level settings:
  Get-SPOSite -Identity https://[tenant].sharepoint.com/sites/Finance | Select-Object Title, SharingCapability | Format-List
  Get-SPOSite -Identity https://[tenant].sharepoint.com/sites/Sales | Select-Object Title, SharingCapability | Format-List
  
  Record all output. Confirm Finance shows a more restrictive value than the tenant default.

⭐ Bonus: Guest access reviews & expiry policies

Reflection & preview

• Ask: "The Finance site is set to 'Only people in your organisation'. A Finance user opens a document in the Payroll Records library and clicks Share — what options do they see?" — answer: they cannot share externally at all; the UI reflects the site's sharing policy
• Ask: "You invited a guest to the Sales site. Your Week 2 CA001 policy requires MFA for all users. When the guest tries to sign in, does CA001 apply?" — answer: yes, if CA001 targets All users. Guests from external tenants may already have MFA from their home tenant, but B2B collaboration policies govern how that's evaluated
• Ask: "The domain allow list only permits contoso.com. A Lakeview Logistics employee wants to share a proposal with a new client at fabrikam.com. What is the process?" — surface the operational cost of allow lists: IT must add the domain before sharing is possible
• Exit ticket: explain the difference between the tenant sharing setting and the site sharing setting — which controls which, and can a site ever be more permissive than the tenant?
• Preview Day 4: external sharing is governed. Day 4 covers OneDrive for Business — storage quotas, sync client policies, Known Folder Move, and what happens to a user's OneDrive when they leave the organisation