You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
# Secure external access to Microsoft Teams, SharePoint, and OneDrive with Azure Active Directory
19
19
20
-
Microsoft Teams, SharePoint, and OneDrive for Business are three of the most used ways to collaborate and share content with external users. If the “approved” methods are too restrictive, users will go outside of approved methods by emailing content or setting up insecure external processes and applications, such as a personal DropBox or OneDrive. Your goal is to balance your security needs with ease of collaboration.
20
+
Use this article to determine and configure your organization's external collaboration using Microsoft Teams, OneDrive for Business, and SharePoint. A common challenge is balancing security and ease of collaboration for end users and external users. If an approved collaboration method is perceieved as restrictive and onerous, end user evade the approved method. End users might email unsecured content, or set up external processes and applications, such as a personal DropBox or OneDrive.
21
21
22
-
This article guides you to determine and configure external collaboration to meet your business goals using Microsoft Teams and SharePoint.
22
+
## External Identities settings and Azure Active Directory
23
23
24
-
## Governance begins in Azure Active Directory
24
+
Sharing in Microsoft 365 is partially governed by the **Exernal Identities, External collaboration** settings in Azure Active Directory (Azure AD). If external sharing is disabled or restricted in Azure AD, it overrides sharing settings configured in Microsoft 365. An exception is if Azure AD B2B integration isn't enabled. You can configure SharePoint and OneDrive to support ad-hoc sharing via one-time password (OTP). The following screenshot shows the External Identities, External collaboration settings dialog.
25
25
26
-
Sharing in Microsoft 365 is in part governed by the [External Identities | External collaboration settings](https://aad.portal.azure.com/) in Azure Active Directory (Azure AD). If external sharing is disabled or restricted in Azure AD, it overrides any sharing settings configured in Microsoft 365. An exception to this is that if Azure AD B2B integration isn't enabled, SharePoint and OneDrive can be configured to support ad-hoc sharing via one-time passcodes (OTP).
26
+
27
27
28
-
28
+
Learn more:
29
29
30
-
### Guest user access
31
-
32
-
There are three choices for guest user access, which controls what guest users can see after being invited.
33
-
34
-
To prevent guest users from seeing details of other guest users, and being able to enumerate group membership, choose Guest users have limited access to properties and memberships of directory objects.
35
-
36
-
### Guest invite settings
37
-
38
-
These settings determine who can invite guests and how those guests can be invited. These settings are only enabled if the integration with B2B is enabled.
39
-
40
-
We recommend enabling administrators and users in the guest inviter role can invite. This setting allows controlled collaboration processes to be set up, as in the following example.
41
-
42
-
* Team owner submits a ticket to be assigned the Guest inviter role, and
30
+
*[Azure Active Directory admin center](https://aad.portal.azure.com/)
31
+
*[External Identities in Azure AD](../external-identities/external-identities-overview.md)
43
32
44
-
* Becomes responsible for all guest invitations.
33
+
### Guest user access
45
34
46
-
* Agrees not to directly add users to the underlying SharePoint
35
+
Guest users are invited to have access to resources.
47
36
48
-
* Is accountable to perform regular access reviews, and revoke access as appropriate.
37
+
1. Go to the Azure Active Directory admin center.
38
+
2. Select **All Services**.
39
+
3. Under **Categories**, select **Identity**.
40
+
4. From the list, select **External Identities**.
41
+
5. Select **External collaboration settings**.
42
+
6. Find the **Guest user access** option.
49
43
50
-
* Central IT does the following
44
+
To prevent guest-user access to other guest-user details, and to prevent enumeration of group membership, select **Guest users have limited access to properties and memberships of directory objects**.
51
45
52
-
* Enables external sharing by granting the requested role upon training completion.
46
+
### Guest invite settings
53
47
54
-
* Assigns Azure AD P2 license to the Microsoft 365 group owner to enable access reviews.
55
-
* Creates a Microsoft 365 group access review.
48
+
Guest invite settings determine who invites guests and how guests are invited. The settings are enabled if the B2B integration is enabled. It's recommended that administrators and users, in the Guest Inviter role, can invite. This setting allows setup of controlled collaboration processes. For example:
56
49
57
-
* Confirms that access reviews are occurring.
50
+
* Team owner submits a ticket requesting assignment to the Guest Inviter role:
51
+
* Responsible for guest invitations
52
+
* Agrees to not add users to SharePoint
53
+
* Performs regular access reviews
54
+
* Revokes access as needed
58
55
59
-
* Removes users directly added to the underlying SharePoint.
56
+
* The IT team:
57
+
* After training is complete, grants the Guest Inviter role
58
+
* To enable access reviews, assigns Azure AD P2 license to the Microsoft 365 group owner
59
+
* Creates a Microsoft 365 group access review
60
+
* Confirms access reviews occur
61
+
* Removes users added to SharePoint
60
62
61
-
Set **Enable Email One-time Passcodes for guests (Preview) and Enable up guest self-service sign via user flows** to **yes**. This setting takes advantage of the integration with Azure AD External collaboration settings.
63
+
1. Select **Email one-time passcodes for guests**.
64
+
2. For **Enable guest self-service sign up via user flows**, select **Yes**.
62
65
63
66
### Collaboration restrictions
64
67
65
-
There are three choices under collaboration restrictions. Your business requirements dictate which you will choose.
68
+
For Collaboration restrictions, business requirements dictate the choice of invitation in relation to domains.
66
69
67
-
***Allow invitations to be sent to any domain** means any user can be invited to collaborate.
70
+
***Allow invitations to be sent to any domain** - any user can be invited
71
+
***Deny invitations to the specified domains** - any user outside those domains can be invited
72
+
***Allow invitations only to the specified domains** - any user outside those domains cannot be invited
68
73
69
-
***Deny invitations to the specified domains** means any user outside of those can be invited to collaborate.
74
+
## External users and guest users in Teams
70
75
71
-
***Allow invitations only to the specified domains** means that any user outside of those specified domains cannot be invited.
76
+
Teams differentiates between external users (outside your organization) and guest users (guest accounts). You can manage collaboration setting in the [Teams Admin portal](https://admin.teams.microsoft.com/company-wide-settings/external-communications) under Org-wide settings. Authorized account credentials are required to sign in to the Teams Admin portal.
72
77
73
-
## Govern access in Teams
78
+
***External Access** - Teams allows external access by default: the organization can communicate with all external domains
79
+
* Use External Access setting to restrict or allow domains
80
+
***Guest Access** - manage guest acess in Teams
74
81
75
-
[Teams differentiates between external users (anyone outside your organization) and guest users (those with guest accounts)](/microsoftteams/communicate-with-users-from-other-organizations?WT.mc_id=TeamsAdminCenterCSH%e2%80%8b)). You manage collaboration setting in the [Teams Admin portal](https://admin.teams.microsoft.com/company-wide-settings/external-communications) under Org-wide settings.
82
+
Learn more: [Use guest access and external access to collaborate with people outside your organization](/microsoftteams/communicate-with-users-from-other-organizations).
76
83
77
84
> [!NOTE]
78
-
> External identities collaboration settings in Azure Active Directory control the effective permissions. You can increase restrictions in Teams, but not decrease them from what is set in Azure AD.
79
-
80
-
***External Access settings**. By default, Teams allows external access, which means that organization can communicate with all external domains. If you want to restrict or allow specific domains just for Teams, you can do so here.
81
-
82
-
***Guest Access**. Guest access controls what guest users can do in teams.
85
+
> The External Identities collaboration feaure in Azure AD controls permissions. You can increase restrictions in Teams, but restrictions can't be lower than Azure AD settings.
83
86
84
-
To learn more about managing external access in Teams, see the following resources.
87
+
Learn more:
85
88
86
-
*[Manage external access in Microsoft Teams](/microsoftteams/manage-external-access)
87
-
88
-
*[Microsoft 365 identity models and Azure Active Directory](/microsoft-365/enterprise/about-microsoft-365-identity)
89
-
90
-
*[Identity models and authentication for Microsoft Teams](/MicrosoftTeams/identify-models-authentication)
91
-
92
-
*[Sensitivity labels for Microsoft Teams](/MicrosoftTeams/sensitivity-labels)
89
+
*[Manage external meetings and chat in Microsoft Teams](/microsoftteams/manage-external-access)
90
+
*[Microsoft 365 identity models and Azure AD](/microsoft-365/enterprise/about-microsoft-365-identity)
91
+
*[Identity models and authentication for Microsoft Teams](/microsoftteams/identify-models-authentication)
92
+
*[Sensitivity labels for Microsoft Teams](/microsoftteams/sensitivity-labels)
93
93
94
94
## Govern access in SharePoint and OneDrive
95
95
96
-
SharePoint administrators have many settings available for collaboration. Organization-wide settings are managed from the SharePoint admin center. Settings can be adjusted for each SharePoint site. We recommend that your organization-wide settings be at your minimum necessary security levels, and that you increase security on specific sites as needed. For example, for a high-risk project, you may want to restrict users to certain domains, and disable the ability of members to invite guests.
96
+
SharePoint administrators can find organization-wide settings in the SharePoint admin center. It's recommended that your organization-wide settings are the minimum security levels. Increase security on some sites, as needed. For example, for a high-risk project, restrict users to certain domains, and disable members from inviting guests.
97
+
98
+
Learn more:
99
+
*[SharePoint admin center](https://microsoft-admin.sharepoint.com) - Access permissions are required
100
+
*[Get started with the SharePoint admin center](/sharepoint/get-started-new-admin-center)
### Integrating SharePoint and One-drive with Azure AD B2B
103
+
### Integrating SharePoint and OneDrive with Azure AD B2B
99
104
100
-
As a part of your overall strategy for governing external collaboration, we recommend that you [enable the Preview of SharePoint and OneDrive integration with Azure AD B2B](/sharepoint/sharepoint-azureb2b-integration-preview) .
105
+
As a part of your strategy to govern external collaboration, it's recommended you enable SharePoint and OneDrive integration with Azure AD B2B. Azure AD B2B has guest-user authentication and management. With SharePoint and OneDrive integration, use one-time passcodes for external sharing of files, folders, list items, document libraries, and sites.
101
106
102
-
Azure AD B2B provides authentication and management of guest users. With SharePoint and OneDrive integration, [Azure AD B2B one-time passcodes](../external-identities/one-time-passcode.md) are used for external sharing of files, folders, list items, document libraries, and sites. This feature provides an upgraded experience from the existing [secure external sharing recipient experience](/sharepoint/what-s-new-in-sharing-in-targeted-release).
> If you enable the preview for Azure AD B2B integration, then SharePoint and OneDrive sharing is subject to the Azure AD organizational relationships settings, such as **Members can invite** and **Guests can invite**.
113
+
> If you enable Azure AD B2B integration, then SharePoint and OneDrive sharing is subject to the Azure AD organizational relationships settings, such as **Members can invite** and **Guests can invite**.
106
114
107
-
### Sharing policies
115
+
### Sharing policies in SharePoint and OneDrive
108
116
109
-
*External Sharing* can be set for both SharePoint and OneDrive. OneDrive restrictions can't be more permissive than the SharePoint settings.
117
+
External Sharing can be set for both SharePoint and OneDrive. OneDrive restrictions can't be more permissive than the SharePoint settings.
110
118
111
119
0 commit comments