Microsoft 365 Guest Access: How it really works, and how to avoid the big mistakes!
ฝัง
- เผยแพร่เมื่อ 7 ก.ค. 2024
- Microsoft 365 Guest Access: how it really works and how to avoid the big mistakes, is my latest video that I take a look at how to correctly setup up guest access in Microsoft 365 and how to avoid any potential pitfalls. From configuration basics in Azure AD and Microsoft 365, I’ll also discuss potential issues in SharePoint Online and Microsoft Teams. If you’re looking to set guest access up, then this is a session you’ll not want to miss.
Please visit my website at www.Andymalone.org
Time codes
00:00 Session introduction
02:06 Microsoft 365 Guest Access Settings
02:48 Creating / Inviting users in Azure AD
07:40 A word about Azure AD Roles
09:38 How to accept a Microsoft 365 Guest invite experience
11:02 Azure AD Guest Inviter Role explained
12:27 Understanding Guest Access in Microsoft Teams
15:48 Understanding Guest Access and the possible pitfalls
16:57 Understanding Azure AD External User collaboration settings explained
21:29 Assigning cloud apps to Guest users in Azure AD
23:36 Managing Guest access within SharePoint Online
26:49 Understanding Guest Vs External Access in Microsoft Teams
30:01 Session review & conclusions - วิทยาศาสตร์และเทคโนโลยี
I am so happy to have found your content. Thank you so much for your clear, informative, and effective way of communicating what others seem to make so complicated. I have been using office 365 in my office now since February and have been looking for content that made sense rather than confuse me even more. I am looking forward to watching your other videos and learning from you. This was my first of your videos and I can't wait to watch the rest!
Thanks so much for your kind comments and it’s great to have you on board. A warm welcome 😊
Excellent - very structured, clear and informative. Keep up the good work.
Hey Andy, eventually a clear , simple and reliable explanation of managing Guest Access in the Tenant. Really appreciated. Hi from Belgium 🍻
Greetings Pierre thank you so much for your kind comments. I’m delighted you enjoyed the video and welcome to the channel, great to have you on board.👍😊
The best video on Guest Access..Thanks..very simple and clear...
Watch out for a new video coming this week on the new features. I think you’ll find it useful.👍😀
Good stuff! I was able to fix a head-scratcher with your clear instructions - thank you!!!!
Great video! Thanks. One thing I missed was a description of the difference between accepting the invite as a guest user with an Outlook/Hotmail account, a commercial email address registered as a MS account and a commercial email address not registered as a MS account.
There is no difference. You can have either a commercial or non-commercial address. In every case it will create a free azure active directory account. There is another type of connectivity for guests. This is called B to C, or business to consumer which is a different topic altogether, and it is where you can allow your developers to produce an app let’s see where consumers can login using Facebook, Twitter and so on. But this is a separate topic and I’ll cover in a later session. Thanks for dropping by asking the question.
@@AndyMaloneMVP Looking forward to your session on B2C.. I am confused as to how it's different from B2B in the context of M365 apps..
@@AndyMaloneMVP I find it almost impossible to collaborate with non-Microsoft people (I'm a consultant and they are my clients). If they don't have a microsoft account I've never managed to get them access to their Teams channel or to their Sharepoint site, despite setting everything to the most inclusive in the sharing admin settings. Very frustrating! Is there a way to give access to someone who's email domain is associated with Google Workspace (i.e. they have not Microsoft identity at all)?
Very clear, super informative and excellent pace that allows following along so effective. Great job, Andy.
Glad it was helpful!
You explained in detail with reference. That's great
Thank you very much 😊
We have implemented our extranet based on this, thanks ✌🏾
All the best👍
Thanks so much. Learned a lot and its very clear and well done. A lot of other channels make it seem so complex and convoluted.
Thank you both kindly, I’ll try my best :-)
Nice video, Andy, you handled the 'guest access is configured in multiple different places' issue very well.
Thanks so much and I really appreciate it
Thank you Sir!
Great tutorial, thanks Andy.
You’re welcome John much appreciated 👍😊
Once again great video and update from the past video
Thanks very much and yes in this cloud world everything has to be updated
Great Video! Thanks Andy! I would love to have 1 video on Teams Voice Part like Enterprise Voice, Phone Edition, PSTN Calling and LineURI etc.
Thanks for the question. I actually recorded a session in voice a little while back. Here’s the link th-cam.com/video/T2RpKS0Kmks/w-d-xo.html
Great stuff!!! Cleared my doubt, which I struggled with for a week. You have saved my day and my customer's days as well. Your help is much-appreciated Sir.
You are very welcome and thanks for the kind comment 👍😊👍
Once again great video Andy. I appreciate the deep dive on the permission side of things. One thing that I'm currently trying to fully understand is scenarios in which one would want to invite outsiders as guest users versus external users. I largely understand the differences and there's pros and cons to both approaches. Any chance you already have a video on this topic that I just need to dig into?
Hi Schyler many thanks for the question. Actually I am thinking about doing a dedicated permissions session in the not too distant future, so you may want to watch out for that. In this case, and as I mentioned in the video you can set permissions for guests in teams as well as in Microsoft 365 groups. You can control the level of permission, in Azure AD. But like I said I will do a dedicated session on this in the not too distant future, thanks again for your question and I’m delighted you’re enjoying my channel
You're helping me to become a better cloud consultant, and I'd like to thank you for that. :)
You are very welcome and never stop learning 😊 👍
nice explanation Andy
Andy, thanks for your videos, they're very well thought out, paced and presented. I have noticed that you have caught the American disease of saying "go ahead" all the time!
You know I love it when folks spot bad habits. I'll try to remember thanks :-D
This video clarified my previous question to you. Thanks indeed. Excellent Video, although there is one aspect that it's still not clear which is how do we prevent 'Guests' from ( as an example) deleting files loaded in the document library . Where are these permissions set ? ( i do not see them in the general choices either in Teams or Sharepoint). Kindly clarify if possible?. Thanks again for your excellent videos . Very informative. Kind REgards Martin.
Thanks for your comments Martin. The question of permissions is actually the user responsibility. When they share an item to a guest, they have the option of sharing it read only or with edit permissions. This is also the same as in OneDrive for business. As an admin you can change the default settings in the SharePoint admin centre. I hope this helps, thanks again.
Great video. Let' say I have an extranet site and want a guest to be able to only see what "that guest" is granted? The way it is set up now, every guest in "extranet" can see all the data in "extranet" I need a way for the internal users to figure out how to add guests without making big mistakes and opening
Hi Thomas thanks for the comments. Have you seen this video th-cam.com/video/rgQE7f_HIvs/w-d-xo.html it’s an update on what you’ve seen previously. I think shared channels would be good for you 👍
Thanks for the video! I've been reading up on guest sharing in M365 and have to admit I am a bit confused with all the different places it looks like you can change guest settings. I'm wondering, in the first step of the video, you went to Org Settings > Microsoft 365 Groups and there was a check-box to allow owners to add guests. But then you went to AAD External Collaboration Settings where you can also change who can invite guests?
I'm not sure I understand the relationship between the two. I assume the AAD External Collaboration setting would overrule the M365 Group Setting? Or am I way off? Thank you for the videos again!
I know how you feel😂🤣 but yes you are correct 😊
Nice video I liked it a lot...time- 5.51 - now MS has renamed Azure AD to Identity in admin center...please add a note in video...
Be already done updated videos on this but thanks for pointing it out
This is a great video for those with the E5-type accounts. Do you have a video for those of us using the Business Basic account and trying to share with external guests? I have not been able to accomplish this. Thanks.
This type of account has limitations. I'd read the service descriptions for Business Basic.
Great video! thank you very much! I have just discover you! I see you have published many many videos! wonderful! I have a question, do you kindly suggest me a video where you exlain in detail the settings of the permissions in sharepoint
Absolutely, there are a number of videos in my SharePoint playlist, including an explanation of the difference between ShareThePoint and windows permissions that you may find useful
Hi Andy, good video certainly going to employ some of the suggestions for sharing and guest user access. My question is once the user has been invited to the organisation. How do they access the resources in that organisation. Do they have to find the invitation email every time? (What if somewhere down the line they loose it or it gets deleted). I have done some testing by looking in my own Microsoft account but cant see any way to pass through from my business resources to the collaboration business resources.
Via teams with a link. Or share directly with the guest user👍😊
Are you able to see what the guest has access to in AD, like if they have access to certain files links will that show up in AD in there profile? Issue I have is I see accounts left for years and are enabled and want to understand if they can still access these files or would that invitation time out at some point
No, but there are really external products that bolt onto 365 like Syskit that can. www.syskit.com/?_bt=504804726409&_bk=syskit&_bm=e&_bn=g&_bg=61072077800
Great video thank you
One question though how do you manage external/guest access so say the external/guest has not logged in 60 days is there a way to remove this user automatically??
You could use conditional access and / or access reviews.
Hello Andy! greate video, thanks. How many guest user can be added to sharepoint site?
Up to 50,000 depending on your Licences
If I am inviting a guest user from a different organisation into a Team, what settings (if any) does that organisation need to have to allow them to join as a guest? does that external organisation need to have 'External Access' configured to allow them to join my domain as a guest?
Hi Lucy thanks for the question. The company that you’re inviting doesn’t have to have any settings configured. Your company however needs to be able to invite guests in. You can do this either in the two ways that I’ve mentioned, via the admin portal in AAD or via Microsoft teams. You can control the collaboration settings in Azure active directory. This will control what users can and cannot do. The rest is pretty much in the video. Thanks so much for commenting and great to have you on board.
Thanks for the great video - Can guests in a M365 group be given access to the shared group mailbox? All current Planner notifications are being directed to the shared group inbox which external collaborators are unable to view within their outlook.
Guests can be members of a Team, which contains a shared mailbox. So the answer is yes.
Thanks for the really informatvie video!
If we have a meeting-room in "Rooms and devices". Can I also add a guest user to a room ressource, so he can also create meetings and book the room for himself?
Yes you can configure permission in teams
Many thanks for informative and clear video, I hope you will help my below issue.
I Invited a guest user, I assigned to him a Microsoft Fabric (Power BI) license, and he cannot see office apps in his MyApps Portal. Microsoft troubleshooting agents said to go into Enterprise Apps, but that's for third party integrations, and office apps are not listed there.
I created a test guest user, and I also cannot see them. When I click the grid menu at the top left in the MyApps portal it says "This is unavailable due to your account permissions and company's settings". I don't understand because I check entra > users > user settings, or enterprise applications > user settings, and I don't see anything related to guest access for apps.
Try converting the guest user to a member user in Entra id properties. Sounds like either a licence of permissions issue.
@@AndyMaloneMVP Tried changing the user type to member in Entra ID but no luck, I have assigned Microsoft Fabric free license to guest user, any other suggestion ?
In our case Guests can’t be found in organizations directory. If I changed the UserType to member then I can add it into Teams l. How I guest can be found with out changing UserType? Thank you
Perhaps check your licence. Are you business basic?
Andy, Thank you so much for the wonderful training video. I added yahoo email account of the user as a gust account and when yahoo user click on Accept invitation then system is keep asking to enter password or it saying sign in with a different Microsoft account? any suggestion. Does external user have to have Microsoft account? Please let me know.
Hi thanks for reaching out. After doing a little research it actually looks like Yahoo mail doesn’t support two-step authentication. Unfortunately this means that is still classified as a legacy client. Legacy clients generally do not support multifactor authentication for outlook. Now this does not mean that it won’t work, but it means that you may need to perform additional actions. Here is an article that you might find of interest.www.msoutlook.info/question/yahoo-two-step-verification
@@AndyMaloneMVP Thank you so much Andy. Last question, Do you provide the consultancy? I will sent you email from my company's email account.
@@khanmali68 Too be honest my schedule is crammed and I'm not able to help at this point. Very sorry. Best of luck though :-)
No Problem, I understand.
Great video - but i could not see how you got into admin settings. Can someone advise on the exact steps?
From Microsoft 365 admin centre, locate the Azure AD admin centre. Within here click on more, then you will see the security options menu. Within here is conditional access. If you don’t see these menus, then you’re not an administrator or have the appropriate permissions
Hello Andy … very nice explaned. I have one problem with a external user . I shared a company folder with him and he can only view it online but he is not able to sync the folder to his pc. Is there any setting in the admin center that i could have missed. Thanks in advance i would appreciate any help or hint
chances are it's either a sharing restriction of a sharePoint settings. Go into the Sharepoint admin centre - Access Control. Explore the settings here as well as Sharing. This is your golden ticket.
Quick question Andy, for some reason can't seem to find the answer for this. Can external users (for example with a gmail account) use the sync feature in Microsoft Sharepoint to sync folders/directories to their PC? I tried that and when OneDrive is launched and the user puts their gmail email address, it does not recognize it. Can you explain?
No. Only licences users of Microsoft 365 use OneDrive for business
@@AndyMaloneMVP If i grant the user an Office 365 E3 license, would they be able to sign in? I'm trying to prevent having to give them a new email address, but they need OneDrive for the Sync feature in Sharepoint
What if a user in the external tenant retires? The administrator in the resource tenant has to remove the guest account conciously ?
Or B2B collaboration includes some functions which remove the guest account automatically ?
Access reviews are a good tool to help you with this.
@@AndyMaloneMVPI understood in this way 'There is no way to remove the retired guest account from the resource tenant automatically. Using 'access reviews', an administrator can get to know the retirement. ' Is that right?
Great video thanks! How does MS not get confused with tenants? i.e. I've guests I'll add but they are part of a 365 tenant already. I've invited them using their MS business account. I guess it should know due to the unique hash added to the email address, am I on the right lines? Also can I add MFA to these accounts?
As I said, there are only two kinds of account member or guest. If you invite a member user from another tenant, it will be represented by a guest account in your tenant. Yes you can enable MFA for guests via conditional access.
Thanks Andy,, quick question if I may. I'm trying to get to the bottom of the most restricted guest user access (last on the list). I'm not clear exactly what is / is not restricted on this setting. Could you explain this please ? Great videos by the way! Cheers, Louis
I'm not sure what you mean. There are only 2 types of user in Azure AD. Member or external (Guest) they are all weighted the same.
@@AndyMaloneMVP Sure. I mean in AAD / Users / User Settings / Manage External Collaboration Settings / Guest Invite Settings there are 3 options, the last of which is "Guest user access is restricted to properties and memberships of their own directory objects (most restrictive)". I'm trying to understand what this setting restricts Guest users to do. I can't seem to figure out what restrictions this option places on Guest users. Thank you.
Hi Andy. Do you see any potential risks in changing the guest type from guest to member? There is such an option in Azure Ad when the client accepts the invitation from us. I would need it to invite users from the gmail domain to use sharepoint which has sharing restrictions for a given domain, and I don't want to add gmail to it because it makes no sense, I would like to treat this guy as a member with a dedicated access to only one directory.
Thanks for the question. I think of a guest user as a contractor or somebody that you want to collaborate with, but who is not necessarily a member of staff. Unfortunately there is no way to convert a Guest user to a fully licensed user. It’s one or the other. However, you can license a guest user, so you can assign a Microsoft 365 license to a user. As you know, guest users can also be given the same rights as a regular users.In Azure AD. Here you can also limit the access as well. You can also configure those permissions in teams, and groups. So in conclusion guests are really useful and flexible resource. Are they perfect? No, but still useful all the same. I hope that helps, Andy
Andy, thank you very much for your reply. The number of functions that Azure offers us is equal to the number of scenarios that we can encounter when working with users. These blocks need to be placed correctly. Thanks again.
Hello Andy.
Please can u help me with a problem? I have two tenants and I have Business Basic and Project plan1 licenses for users in both tenants. I'm creating a project in tenant A and sharing it with tenant B users, that is, with guests. These guests have the Project plan 1 license, but can only have viewing access in the project. When sharing I gave editing permission but they can only open as a preview. What could be wrong?
Check your overall tenant permissions in SharePoint online. Then check your resource permissions, for example, teams, project and so on. It sounds like there is a conflict. Another issue could be sharing the restrictions because of business basic. Again just a thought. Good luck
On my Microsoft365 environment, '+New guest user' button is not displayed on the 'Users|All user' screen.(Time on the video: 6:10).Inviter role is assigned to No user.
What can be considered as the cause ?
Since I recorded this video it's changed to New external user. If you don't see it. you don't have the correct licence. G inviter is unassigned by default.
I checked my environement and found 'Invite external user' under the '+New user'. Thank for your information.
Just tried using guest access and it's forcing the guests to use Microsoft Authenticator. What happened to password access for guests? Is there a way to turn off Authenticator requirements for Guests?
Microsoft are winding down the use of passwords. MFA and password is authentication is coming in big time.
Thanks Andy I actually meant why password & SMS is no longer being used but I've just talked to MICROSOFT and apparently there's some obscure settings in Azure that allow me to go back and add that to certain groups. are you aware of that? It's a useful feature when you have for example a board of directors that are technologically, not very savvy, and you want them to access a single SharePoint site and simply use a password and text challenge as we have been using all along in the last few years in the financial industry.
Hello, great video! Can you explain please: We have Anyone links enabled, and have a tons of such links. What happens with Anyone links, if I enable: SharePoint Admin center -> Policies->Sharing->Choose expiration and permissions options for Anyone links->This links must expire within 30 days ? ALL Anyone links older then 30days will expire? Or it's only works on newly created links? And what if someone want's to create Anyone link and set expiration in 90 or 120 days? is it possible with global expiration enabled on 30days? Thanks.
The anyone link is exactly as it says on the tin. It allows anyone in your organisation to share content anonymously. In addition it also allows those anonymous users to share anonymously as well. So the problem here is that your content can easily get out of control. This is not a recommended sharing option by Microsoft. Thanks for the question and the nice comment and great to have you on board. All the best, Andy
@@AndyMaloneMVP Yes, but we can't turn off Anyone links completely. Set Expiration is nice solution, just can't find info about two questions: 1. That happens to existing links and 2. can user override expiration time? May be will test it soon. Thanks
@@TheRumbman Anything you set at the tenant level will over ride at site level. However, If you must have anonymous links. Have some kind of guidance / training for staff to use. Individual site collections can over ride. More info please see training materials at docs.microsoft.com
Andy showed how to turn off 'anyone' links in his video.
Hi Andy, very good video and introduction, I watched all the video and it was very informative. However I must admit that I came here to resolve a simple issue, I am kind of consultant and advisor for another company to introduce 365, I am registered as guest. Unfortunately I can not see any To Do assigned to me in my personal task list. It looks like a miss in all the Guest system. Do you a have experience or an idea around this issue? Anyway, Good Video.
Unfortunately not I’m afraid. I do know they’re moving it to other apps
can user without License ( not guest ) use MS teams ?
No
Roughest part is having guest with existing existing O365 accounts, it creates some confusion for them. Same with work/personal O365 accounts on the same email address.
This should not be an issue as guest accounts are generally used with external email addresses not internal email addresses. It also creates a free as your ID account. Although you can use guest accounts as administrators and you can also license guest accounts. However I don’t see the point of this.
@@AndyMaloneMVP An example of liquidflorian's point is when a gmail account, for example, also exists as a Microsoft account, which you can do (and I did ... and then forgot that I had!). When you share a file with the gmail account, or add to a team etc., the invitation user flow first attempts to log you in with the Microsoft account, which, of course, doesn't exist within Azure AD, so inviting a guest always results in an access denied. Peculiarly, if you wait 1 min 52 secs before clicking to open the shared file / invite etc., you then get the option to use a One Time Passcode. Submitted this to Microsoft as a bug last week.
@@davidadams421 interesting Thanks sharing and let me know what their responses.
After inviting a guest user to a Team, how can I configure that the guest only has access to selected channels?
Hi David. Great to hear form you. No is the short answer. However you could give direct access via SharePoint permissions to the channel site. Unless it's a private site. That's the only workaround I can think of.
How to convert guest user to member user and as I have created a guest already it's showing two account one is member another is guest .. could you please help
Entra Id user properties. Change member type to guest.
This is is a priceless video !
By the way, I have 2 questions.
1)When we use the guest features explained in this video, does the 'B2B collaboration' always works?
2)Do you offer some tutorials which explains how to use 'Auditing and reporting B2B collaboration users'?
1 - Yes If it's configured correctly. 2 - Not yet, but that's a great idea. I'll add it to my request list :-)
Hi Andy, great and very informative. I am an admin and wanting to know how to get a Guests report. Was wondering if you have any resources you could direct me to. Thanks Cliff
Hi Cliff thanks very much for your question. The short answer is, not easily. However I’m currently working with a software vendor who produces a brilliant piece of software for managing teams & more.it’s called Syskit. You might want to take a look at it. In the short term you can filter guests and external users produce basic reports, however it’s a little basic in this case I would recommend third-party software until Microsoft to get their act together. Thanks again and I hope this helps, Andy
@@AndyMaloneMVP thanks will look into this further.
@@clifffernandes5814 No problem for the record I’m not playing with the software myself, I’ve only seen a demo so far. Good luck.
@@AndyMaloneMVP I am also looking into PowerShell scripting to see if it’s possible to get a report. Thanks
what about tenant synchronisation?
Doesn’t matter. Tennant A’s users will come in as Tennant B’s guests and vice versa.
About the amount of users i need (licences).... i am confused because
we have about 6 windows machines using office and what not.
but we have about 20 employee's using these mashines as well as their private smartphone and so on.
So for us as a company to use Microsoft Teams with ALL our employees in it... how many Microsoft 365 / Teams licensces/users would i need to pay for?
Can i just buy as many licenses so that all mashines have proper office support....e.g. 3 users with 2 devices each??? And i can add all the employees using their company email?
I heard there is also the problem of teams being split into two apps (personal and business).
How do i solve this?
Do i really have to pay for 20 Microsoft 365 users just so that 20 people can chat with each other? Although i only need Office on 6 mashines?
Microsoft 365 users can install office 365 and up to 5 PCs or Macs each plus up to 15 mobile devices there are also shared licensing options which you may want to look into.
I know licensing is a minefield believe me. Have you looked at M365 maps.com? That’s a really good site.
You covered teams access, what about email/shared mailboxes are guest able to access them or so.etbi g equivalent?
These topics are all covered under the relevant topic playlists. Check them out!