OneDrive external sharing no longer working with "Allow invitations only to the specified domains"

Question

OneDrive external sharing no longer working with "Allow invitations only to the specified domains"

Bejhan Pacadzioski 20

Hi,

Due to the transition from SharePoint Online and OneDrive to Microsoft Entra B2B, external sharing can no longer be used as before if the setting “Allow invitations only to the specified domains (most restrictive)” is enabled in Entra ID.

At the same time, we would like to continue allowing OneDrive and SharePoint files to be shared with external users, even if their email domain is not included in the allowlist configured in Entra ID.

Problem

Since July 2026, it has no longer been possible to share OneDrive files with external users whose domain is not included in our allowlist. This behavior appears to be related to the transition of SharePoint Online and OneDrive to Microsoft Entra B2B.

Our current configuration

Entra ID

Collaboration restrictions --> Allow invitations only to the specified domains (most restrictive)

SharePoint Online

User's image

Our Requirements

We would like to continue meeting the following objectives:

Enable sharing of OneDrive and SharePoint files with external users
Do not fully open access to guest users from any domain
Guests in Teams should only be able to be added from defined domains
Chats and meetings with external users should continue to be possible for all domains

Desired Target Configuration

Entra ID should remain restricted to “Allow invitations only to the specified domains (most restrictive)”
Enable sharing of OneDrive and SharePoint files with external users, even if their domain is not included in the allowlist
External users should be able to receive files without having to create an Entra B2B guest for each domain
Teams guests should be allowed only from defined domains
Teams chats and Teams meetings should continue to be possible with external users from all domains

Best regards,
Bejhan

0 comments

Answer accepted by question author

Liora D 18,920 Microsoft External Staff Moderator

Dear @Bejhan Pacadzioski,

I hope you’re having a good day.

Thank you for the detailed explanation of your requirements.

Based on Microsoft's current External Identities and SharePoint Online architecture, the behavior you are seeing appears to be expected. When "Allow invitations only to the specified domains" is enabled in Microsoft Entra External Identities, guest invitations are restricted to the domains included in that allowlist. Because SharePoint Online and OneDrive now rely on Microsoft Entra B2B for guest collaboration, external sharing invitations are also evaluated against the same restriction.

This means the desired configuration of:

Restricting Teams Guests to approved domains only,
While allowing SharePoint and OneDrive sharing to users from any external domain,

does not appear to be supported through a separate policy today, because Teams Guests, SharePoint Guests, and OneDrive Guests all use the same Entra B2B invitation framework.

Given your objectives, there are two realistic approaches to consider:

If controlling which organizations can become guests is the highest priority, keeping the Entra allowlist is likely the best option. In that case, external users who need access to SharePoint or OneDrive content would need to belong to domains included in the allowlist, and additional partner domains can be added as business requirements evolve.

If flexible file sharing is the higher priority, consider changing the Entra setting to allow invitations to any domain and then applying governance at other layers, such as SharePoint sharing policies, sensitivity labels, Conditional Access, access reviews, and cross-tenant access settings. This allows broader document sharing while still maintaining administrative controls over external access

One point that may help with your requirements is that Teams External Access (federated chat and meetings) is separate from Teams Guest Access. As a result, organizations can often continue to support external chats and meetings with users from many domains without creating guest accounts, while keeping tighter controls on guest collaboration.

Based on the currently published documentation, I have not found a supported configuration that would allow SharePoint and OneDrive guest sharing to bypass the Entra domain allowlist while simultaneously keeping Teams Guest access restricted to only approved domains. This makes the current behavior look more like a consequence of the Entra B2B integration model than a service regression.

For additional reference:

If this workflow was functioning differently in your environment before July 2026, it may be worth reviewing any Message Center announcements or change records around that timeframe. That information could help determine whether a specific service rollout changed the sharing experience, or whether another tenant-level setting was previously allowing the scenario.

I hope this information helps point you in the right direction. Please feel free to reply below if you have any update or further concern.

Warm regards,

If the answer is helpful, please select "Yes" and kindly upvote it. If you have extra questions about this answer, please click "Comment".

Note: Please follow the steps in our documentation to enable e-mail notifications if you want to receive the related email notification for this thread.

Deleted

This comment has been deleted due to a violation of our Code of Conduct. The comment was manually reported or identified through automated detection before action was taken. Please refer to our Code of Conduct for more information.

1 additional answer

Your answer

Deleted

This comment has been deleted due to a violation of our Code of Conduct. The comment was manually reported or identified through automated detection before action was taken. Please refer to our Code of Conduct for more information.

Answer 1

Bejhan Pacadzioski 20

Hi @Liora D

Thank you very much for the detailed and clear explanation — this confirms what we suspected after digging into the architecture ourselves.

One follow-up question:

Is there any roadmap item to allow scoping the Entra B2B collaboration restrictions (domain allow/deny list) per workload - e.g., a separate policy for Teams guest invitations vs. SharePoint/OneDrive guest invitations? This seems to be a common requirement now that OTP-based SharePoint sharing has been retired, since many organizations want flexible file sharing without opening up Teams guest access to the same degree. Thanks again for your help - marking this as accepted.

Best regards,

Bejhan

Liora D 18,920 Reputation points Microsoft External Staff Moderator

2026-07-23T13:32:06.1666667+00:00
Hi Bejhan,

Thank you for the follow-up question and for sharing the additional context.

I agree that this would be a valuable capability for many organizations, especially in scenarios where the desired governance model for Teams Guest access is more restrictive than the governance model for SharePoint and OneDrive file sharing.

At the time of writing, I have not found any publicly available Microsoft documentation or roadmap item indicating plans to scope Entra B2B collaboration restrictions (allow/deny domain lists) separately by workload, such as applying one policy to Teams Guest invitations and a different policy to SharePoint/OneDrive guest sharing. The current documentation continues to describe domain restrictions as part of the tenant-wide External Collaboration settings used for B2B collaboration.

The available guidance also indicates that Teams Guests, SharePoint Guests, and OneDrive Guests all rely on the same Entra B2B collaboration framework, while workload-specific controls are primarily provided through other mechanisms such as SharePoint sharing policies, Cross-tenant Access settings, Conditional Access, sensitivity labels, and access reviews.

Because roadmap information can change and some features are announced before documentation is updated, the best places to monitor for future developments are:

Microsoft 365 Roadmap

Microsoft Tech Community blogs for Microsoft Entra, SharePoint, OneDrive, and Teams

Thank you again for sharing your findings and confirming the behavior. The architectural insight you provided will likely be helpful to other administrators who encounter the same change following the move to the Entra B2B-based model.