How to setup external guests and allow them access to SharePoint

Step-by-step guide to allow external guests into your tenant and to be able to log into your SharePoint site

Inevitably, you will need to collaborate and share with users who are outside of your company or organisation, and in order to maintain security, you will nee to do it the correct way so that guests are onboarded in a controlled way and only have access to what you want to grant them access to, nothing more.
Start off with setting the rules of guest sharing from SharePoint Administration, which you can find on the left hand side of the screen under "Policies". Click on "Sharing".

Setup on SharePoint Admin

In our instance, we adjusted the SharePoint indicator to "New and Existing Guest", but in practice we allocated guests to "Existing guests" on an individual basis. Reason being is that onboarded guests become "existing guests" so that indicator works without being too restrictive.

For OneDrive, we were less permissive. Due to our policy being that OneDrive is for drafts and personal documents, we found no reason why users would need to share these with external guests. Quite simply, if users want to share with guests, then they will need to upload to a site and share it that way.

Adjust the indicators

Before we can add users to a SharePoint site, we need to add them to Azure Entra which acts as a kind of Active Directory that you can use to register and maintain guest and user profiles.

When in Entra:

Click on "All Users", and then "New user"
In the dropdown menu, click on "Invite external user"

Setting up users on Azure Entra

Complete the necessary information.
Typically, for guests who aren't very long term, I would miss out on most of the information. But the following are crucial:
  • Email - Invitation email is going to be sent here and the guest is going to need to use this to verify themselves later on.
  • Display name - Can just use first name if necessary. Used to call up the profile when adding to a site.
  • Send invite message - Typically I would tick this and also add the redirect URL, so that the guest isn't met with a blank Apps page, which can be confusing
On the Assignments tab:
For our instance, it was a security policy that guests could upload and edit documents in-place, but downloading was not permitted. Thereby in this section, we had created a group policy that allowed downloads and users were added to this groups membership. However, this is on a case by case basis.

Click on the Review + invite tab and then click "Invite" at the bottom. From our experience, the change usually takes a few seconds to take effect.