Helpdesk: "A project manager tried to share the Partners site with someone at the vendor and got Your organization's policies don't allow you to share with these users. Can you just set SharePoint to Anyone so this stops?" Twenty minutes later a second ticket: a contractor who has opened the same folder link for a year now gets access denied, and someone wants to delete and re-invite every guest on the site.
Don't flip the whole tenant to Anyone yet. SharePoint external sharing isn't one switch. It's a stack of settings, and the most restrictive layer wins. A share only succeeds when the whole chain holds: the organization-level SharePoint (and OneDrive) setting allows that level → the site's own setting allows it (site type default, admin change, or a sensitivity label) → no domain allow/block list in SharePoint or Microsoft Entra ID rules out the recipient → the person sharing is allowed to share (security-group limit, Entra guest invite settings, site sharing permissions) → the Microsoft 365 group or team allows guests, if the site is group-connected → the guest can redeem and pass sign-in (B2B guest account, Conditional Access, cross-tenant access) → you waited for the change to apply. Microsoft's own troubleshooting for that error starts at the org and site sharing settings, not at re-inviting anyone.
If the guest can't sign in at all and sees an AADSTS code, that's a different chain. See AADSTS50020 user account does not exist in tenant or AADSTS53003 blocked by Conditional Access. This post covers SharePoint and OneDrive sharing that looks like it "isn't working": the share is refused, the Anyone option is missing, or an external person who used to get in now gets access denied.
TL;DR
- Most restrictive wins. The site setting can match the org setting or be stricter, never looser. OneDrive can match SharePoint or be stricter. Read both levels before you change either.
- Site type sets the default. Communication sites, classic sites, and modern sites with no group default to Only people in your organization, even when the tenant allows guests. A "new site doesn't share" ticket is often just that.
- Domain lists live in two places. SharePoint's Limit external sharing by domain (org and site) and Entra ID's collaboration restrictions both apply. Since 2026 SharePoint uses Entra B2B for new external sharing in commercial tenants, so the Entra list always matters now.
- Who can share is its own layer. Allow only users in specific security groups to share externally, Entra guest invite restrictions, and the site's sharing permissions can each block one user while everyone else shares fine.
- October 2026 changes the "it worked last month" case. Microsoft is retiring SharePoint one-time passcode (SPO OTP) for commercial tenants. External users with no matching Entra B2B guest account get access denied on previously shared Specific people links. Create the guest account or reshare one item. Don't reshare everything.
- Don't set the tenant to Anyone to fix one site. Anyone links aren't authenticated and can be forwarded. Fix the layer that's actually blocking.
Where in the chain did it break?
| Step | What should be true | Typical symptom when it breaks |
|---|---|---|
| 1. Symptom captured | Exact error text, who shared, from which site/OneDrive, to which address | "Sharing is broken" with no site URL or recipient |
| 2. Org level | SharePoint (and OneDrive) set to New and existing guests or Anyone | Your organization's policies don't allow you to share with these users everywhere |
| 3. Site level | Site set at or below the org level, but not to Only people in your organization | One site refuses; others share fine. New communication site never shares |
| 4. Domain lists | Recipient domain allowed in SharePoint (org + site) and in Entra collaboration restrictions | One partner domain fails; Gmail works, or the other way around |
| 5. Who can share | Sharer is in the allowed security group, can invite guests in Entra, and has sharing rights on the site | One user fails; the site owner succeeds |
| 6. Group / team guests | Group-connected site allows guests (M365 Groups and Teams settings) | Guest added to the team can't open Files / site content |
| 7. Guest side | Matching B2B guest account, redemption done, not blocked by CA or cross-tenant access | Old link now access denied; guest loops on sign-in |
| 8. Waited | Retested after the change applied | "Still broken" five minutes after a change |
Write down the site URL, the sharer's UPN, the recipient's exact email address, the link type they tried (Specific people / Anyone / People in your organization), and the exact message, ideally a screenshot.
Step 1: Capture the exact symptom (read-only)
| What the user sees | Most likely layer |
|---|---|
| Your organization's policies don't allow you to share with these users | Org or site sharing level (Microsoft's documented cause), then domain lists |
| Error only for one partner domain | SharePoint or Entra domain allow/block list |
| Share dialog has no Anyone with the link option | Org or site isn't set to Anyone, or the sharer's security group is Authenticated guests only |
| Default link is People in your organization even though the tenant default is Anyone | Site doesn't allow Anyone. Microsoft documents this fallback |
| Recipient already in the directory, no error on share, but blocked on open | Domain restriction. Microsoft notes existing directory users don't trigger the share-time error |
| Previously working Specific people link now access denied (October 2026 onward) | SPO OTP retirement. No matching Entra B2B guest account |
| Guest loops or sees an AADSTS code | Entra sign-in, not SharePoint sharing. Go to the sign-in log |
Microsoft's troubleshooting article for the "policies don't allow" message says it generally means external sharing is turned off for your SharePoint or OneDrive sites, and walks the org setting, then the site setting, then OneDrive. Follow that order.
Step 2: Read the organization-level setting (read-only)
SharePoint admin center > Policies > Sharing. Note both sliders:
| Level | What it allows |
|---|---|
| Anyone | Unauthenticated Anyone links for files/folders, plus sharing with guests who sign in |
| New and existing guests | Guests sign in (work/school or Microsoft account) or verify with a code; new guests are added to the directory |
| Existing guests | Only guests already in your directory |
| Only people in your organization | External sharing off |
The OneDrive setting can be the same as SharePoint or stricter, never looser. Also expand More external sharing settings and note Limit external sharing by domain, Allow only users in specific security groups to share externally, Allow guests to share items they don't own, and guest access expiration.
# Read-only. SharePoint Online Management Shell, signed in as a SharePoint Administrator.
# Connect-SPOService -Url https://contoso-admin.sharepoint.com
Get-SPOTenant | Select-Object SharingCapability, OneDriveSharingCapability,
SharingDomainRestrictionMode, SharingAllowedDomainList, SharingBlockedDomainList,
DefaultSharingLinkType, EnableAzureADB2BIntegration
# SharingCapability values: Disabled | ExistingExternalUserSharingOnly |
# ExternalUserSharingOnly | ExternalUserAndGuestSharing (= Anyone)
# EnableAzureADB2BIntegration no longer controls behavior in commercial tenants (B2B is always on for new sharing).
If the org is Only people in your organization, stop. Every site inherits that ceiling. That's a policy decision for whoever owns external collaboration, not a helpdesk fix.
Step 3: Read the site-level setting (read-only)
Active sites > select the site > Settings > More sharing settings. Site owners can't change this. It takes a SharePoint Administrator.
Microsoft's default sharing setting by site type:
| Site type | Default |
|---|---|
| Group-connected (including Teams) | New and existing guests if Let group owners add people outside the organization to groups is On; otherwise Existing guests |
| Communication | Only people in your organization |
| Modern site with no group | Only people in your organization |
| Classic | Only people in your organization |
| OneDrive | Anyone |
The root communication site (tenant.sharepoint.com) defaults to Anyone.
# Read-only. Compare the site to the tenant ceiling from Step 2.
$site = 'https://contoso.sharepoint.com/sites/Partners'
Get-SPOSite -Identity $site | Select-Object Url, Template, GroupId, SharingCapability,
SharingDomainRestrictionMode, SharingAllowedDomainList, SharingBlockedDomainList,
SensitivityLabel
# A non-empty SensitivityLabel can mean the label controls this site's external sharing.
Two traps here:
- Sensitivity labels. A container label with Control external sharing from labeled SharePoint sites sets the site's sharing level. Microsoft also warns that label settings can hand site owners control over things that are normally admin-only. If the label says Only people in your organization, editing the site setting by hand isn't the fix. The label decides.
- Channel sites. Private and shared channel sites have their own entry (Channel sites column). Check the channel site, not just the parent team site.
Step 4: Domain allow/block lists, in both places (read-only)
- SharePoint org level: Policies > Sharing > Limit external sharing by domain (allow list or block list, up to 5,000 domains, no wildcards).
- SharePoint site level: Site > More sharing settings > Advanced settings for external sharing. A site allow list must be a subset of an org allow list. If the org already has an allow list, you can't use a site block list. The org setting wins on conflicts.
- Entra ID: External Identities > External collaboration settings > Collaboration restrictions. Microsoft says the Entra allow/deny list affects SharePoint and OneDrive site sharing always, and file/folder sharing when B2B integration is on. Since B2B is now on for new sharing in commercial tenants, treat it as always in play.
Microsoft also notes that Entra collaboration restrictions control who can be invited and don't affect guests already in the directory. For SharePoint's own domain list, an existing directory guest on a blocked domain doesn't get a share-time error but is blocked when they try to open the site. That's why "it shared fine, but they can't get in" usually comes back to a domain list.
Step 5: Is this user allowed to share? (read-only)
When the site owner can share and one project manager can't:
- Security-group limit: Allow only users in specific security groups to share externally (up to 12 groups, each set to Authenticated guests only or Anyone). Microsoft states those users must also be allowed to invite guests in Entra guest invite settings. If the group is Authenticated guests only, that user won't get Anyone links.
- Entra guest invite restrictions: External collaboration settings > Guest invite restrictions. If only admins or specific roles can invite, a regular member's share to a new guest fails, while sharing with existing guests can still work.
- Site sharing permissions: Site permissions > Change how members can share. Options run from owners and members sharing files, folders and the site, to only site owners can share. Site members who "can't share" may just be under the owners-only option.
- Guest resharing: Allow guests to share items they don't own (org setting). Guests can always share items they have full control over.
Step 6: Microsoft 365 Groups and Teams guest settings (read-only)
For group-connected sites, Microsoft says Groups and Teams guest settings also affect the connected SharePoint site:
- Microsoft 365 admin center > Settings > Org settings > Microsoft 365 Groups: Let group members outside your organization access group content and Let group owners add people outside your organization to groups.
- Teams admin center > Users > Guest access (Microsoft notes this can take 24 hours to take effect).
- Guest settings can also be set for one specific group, so check the group itself, not just the org defaults.
Microsoft's site-sharing article also says that if a Microsoft 365 group with guest members has group settings that block guest access to group resources, guests might not be able to reach site content even with site sharing on. And if guests are allowed in Teams but not in SharePoint, they lose the Files tab, because Teams files live in SharePoint.
Step 7: The guest side: B2B account, OTP retirement, sign-in (mostly read-only)
Entra B2B is now the model. Microsoft's integration article says that between May and July 2026 it enabled SharePoint/OneDrive integration with Entra B2B for new external sharing in commercial tenants. EnableAzureADB2BIntegration no longer controls that, and it can't be disabled. Each invited person gets a guest account and is subject to Entra policies such as MFA and Conditional Access.
SPO OTP retirement (October 2026). Microsoft is retiring SharePoint one-time passcode authentication for commercial tenants during October 2026, with no opt-out and no choice of date. Once it reaches your tenant:
- External users with a matching Entra B2B guest account keep access to previously shared links.
- External users without one get access denied on previously shared Specific people links.
- The fix Microsoft documents: an admin creates a guest account for the email address used on the original link, or someone with sharing rights shares or reshares at least one file, folder, or site with that person. You don't reshare every item. Duplicate guest accounts aren't created.
- Anyone links aren't affected. Entra B2B email one-time passcode is not being retired.
- Microsoft points to the site external sharing report ("User E-mail" column) to find SPO OTP guests who don't have a B2B account yet.
Older background: Microsoft also notes that since June 2024, invitations sent through the legacy SharePoint Invitation Manager no longer grant access. Users must reshare to generate valid invitations.
# Read-only. Microsoft Graph PowerShell. Does a matching B2B guest exist for the link's email?
Connect-MgGraph -Scopes 'User.Read.All'
$mail = 'pat@fabrikam.com' # the exact address the link was shared to
Get-MgUser -Filter "userType eq 'Guest' and mail eq '$mail'" `
-Property Id,DisplayName,Mail,UserPrincipalName,ExternalUserState,CreatedDateTime |
Select-Object DisplayName, Mail, UserPrincipalName, ExternalUserState, CreatedDateTime
# Guest UPNs contain #EXT#. No result = no matching guest (check aliases / otherMails before concluding).
If a guest account exists and the person still can't get in, read their sign-in log in Entra. Conditional Access, cross-tenant access inbound settings (B2B collaboration defaults to All allowed, but a partner-specific entry can block), and redemption problems show up there, not in SharePoint. The AADSTS50020 and AADSTS53003 triages cover those.
Also check guest access expiration (org or site): guests whose access expired need the site owner to renew it. That isn't a sharing-level bug.
Step 8: Change one layer, then retest with one recipient
- Fix the single layer Steps 2–7 point at (one site, one domain entry, one group setting).
- Retest with the same sharer, site, and recipient address.
- Allow time: Microsoft says that when you restrict sharing, guests typically lose access within about an hour. Sensitivity label setting changes can take 24 hours to replicate. Teams guest access can take 24 hours.
- Confirm the recipient opens the item, then widen the change (more sites, more domains) if that's the intent.
Timing: when "still broken" is just waiting
| Change | What to expect |
|---|---|
| Org or site sharing level changed | Retest after a short wait; when restricting, guests typically lose access within about one hour |
| Org sharing turned off, then back on | Sites return to their previous setting and guests regain access. Lock specific sites first if they shouldn't |
| Sensitivity label (site/group settings) edited | Microsoft says wait at least 24 hours for existing labels |
| Teams guest access toggled | Can take up to 24 hours |
| SPO OTP retirement reaches the tenant (October 2026) | Old Specific people links fail for users with no B2B guest until a guest exists or one item is reshared |
| New guest created or one item reshared | Previously shared links work again for that person without resharing each item |
When a change is justified
| Finding | Prefer | Avoid |
|---|---|---|
| Org = Only people in your organization | Escalate to the collaboration/security owner; decide the level deliberately | Quietly flipping the tenant to Anyone |
| One site is stricter than intended | Change that site's setting (or its sensitivity label) | Raising the org level to "fix" one site |
| Communication site never shares | Set that site to New and existing guests if it should be external | Treating the default as a bug |
| Partner domain blocked | Adjust the right list (SharePoint org/site or Entra) after confirming intent | Removing all domain restrictions |
| One user can't share | Add them to the allowed security group / Entra invite rights / site sharing permissions | Granting them site owner or SharePoint admin |
| Old link access denied after OTP retirement | Create the matching B2B guest or reshare one item | Resharing every file, or switching everything to Anyone links |
| Guest blocked at sign-in | Read the Entra sign-in log (CA, cross-tenant access, redemption) | Changing SharePoint sharing settings |
| Guest access expired | Site owner renews access | Turning expiration off tenant-wide |
FAQ
Why is SharePoint external sharing not working?
Usually one of: the org or site sharing level is too restrictive (most restrictive wins), the site type defaults to internal-only, a SharePoint or Entra domain list blocks the recipient, the sharer isn't allowed to share or invite, group/Teams guest settings block a group-connected site, or the guest side fails (no B2B account after SPO OTP retirement, Conditional Access, expired access). Start at SharePoint admin center > Policies > Sharing, then the site's More sharing settings.
What does "Your organization's policies don't allow you to share with these users" mean?
Microsoft's troubleshooting article says it generally means external sharing is turned off for the SharePoint or OneDrive location. Check the org setting, then the site setting (or OneDrive setting), and make sure the site is at New and existing guests or Anyone if it should share externally. Then check domain lists.
Why is the Anyone link option greyed out or missing?
Anyone links only exist when both the org and the site are set to Anyone. If the sharer is restricted to a security group set to Authenticated guests only, they won't get Anyone links either. Microsoft also documents that when the site doesn't allow Anyone, the default link falls back to People in your organization.
Why did an external user lose access to a link that worked before?
In October 2026, Microsoft is retiring SharePoint one-time passcode for commercial tenants. External users without a matching Entra B2B guest account get access denied on previously shared Specific people links. Create a guest account for the email address on the original link, or reshare at least one item with them. Also check guest access expiration and any recent domain-list or site-level change.
Can a site owner change the external sharing setting?
No. Microsoft says you need at least SharePoint Administrator to change a site's sharing setting, and site owners can't. The exception is a sensitivity label configured for external sharing: a site owner who can apply or change the label can change the site's sharing level that way.
Related posts
- AADSTS50020 User Account Does Not Exist in Tenant (guest can't sign in: wrong tenant, invite, redemption)
- AADSTS53003 Blocked by Conditional Access (sharing works, guest blocked at sign-in)
- Restore a Deleted SharePoint Site, OneDrive, or File (when "can't access" is really "it's gone")
- A Monthly Exchange Online Hygiene Check: External Forwarding and Mailbox Permissions (the mail-side external exposure review)
- Conditional Access Report-Only Results, Logs, vs On (test guest CA policies before you enforce)
Free checklist
Once sharing works again, the next request is usually "require MFA for guests" or "block guests from everything except this site," and that's where a rushed Conditional Access change locks the same partners out. Before you enforce, the free Conditional Access pre-enforcement checklist keeps break-glass accounts, pilot groups, and report-only review on one page:
If you want a starting policy set and the exclusions pattern written down before guest policies grow, the Entra ID Conditional Access Starter Pack has a starter policy library, a break-glass and exclusions playbook, and read-only Graph exports for policies and named locations: https://cashflow4375.gumroad.com/l/nhuyrc?utm_source=devto&utm_medium=article&utm_campaign=aps_first_sale&utm_content=sharepoint-external-sharing-not-working
Admin Pack Studio; not affiliated with Microsoft. Steps 1–7 only read: admin center pages, Get-SPOTenant, Get-SPOSite, and a Get-MgUser lookup. Changing org or site sharing levels, domain allow/block lists (SharePoint or Entra), security-group sharing limits, guest invite restrictions, Groups/Teams guest settings, sensitivity labels, and creating or deleting guest accounts are deliberate changes. Make them on one site or one recipient first, retest, and check current Microsoft Learn for portal labels and rollout timing.
Top comments (0)