Guest access creates an Entra ID object for a person who does not belong to your tenant, usually with their existing work or personal email. External sharing is a permission or a link on a SharePoint file, a library, or a Team. A guest can be invited and still see nothing until something is shared. A sharing link can go to a person who was never added as a guest.
This is operational guidance, not legal advice. Treat client files as personal data under Malaysian PDPA practice: share the least, name an owner, and set an end date.
Guests vs links
Guests sign in. You can require MFA, see them in the directory, add them to a Team, and disable the account when the project ends.
Sharing links come in types SharePoint still labels in similar words:
- People in your organisation
- Specific people (email addresses you name)
- Anyone with the link (no sign-in, if the tenant allows it)
“Anyone” links are convenient and hard to audit. They survive in email threads after the project ends. Prefer specific people or a guest on the Team when the file is not a public brochure.
Tenant settings cap what site owners are allowed to do. A site owner cannot create an “anyone” link if the tenant forbids it. Start at the tenant, then open exceptions on named sites, not the other way around.
Sharing a project with an outside firm
- Confirm the tenant allows guests or specific-people links
- Create or reuse a Team or a library whose members should see the work
- Invite the external people as guests, not as new licensed staff
- Share that Team or library, not the whole intranet
- Set an expiry, name an internal owner, and remove guests when the job ends
Teams, SharePoint, and OneDrive
Adding a guest to a Team gives them the channels you allow and the SharePoint content those channels use. It does not automatically give them every site in the tenant.
A library can allow guests while the rest of the site does not, if inheritance is broken. That is an exception to manage, not a default.
OneDrive sharing is personal. Staff will send OneDrive links unless you tell them to move records into SharePoint first. Guests who only ever received OneDrive links will not appear as Team members.
B2B collaboration (guest accounts) is different from B2B direct connect and from unmanaged “anyone” links. If a partner has their own Microsoft 365 tenant, a guest account in your directory is still the usual SME pattern.
Hygiene
Review guest accounts the way you review leavers. A contractor who finished last year and can still open last year’s channel is a directory problem, not a Teams problem.
Do not invite guests as Global Administrators. Do not use a shared guest mailbox. Do not paste “anyone” links into a public website and call it a portal.
A practical example
An agency shares a client folder with an “anyone, edit” link and posts it in a WhatsApp group. The link is forwarded to a subcontractor the agency never met. The revision creates a Project Team, invites the client’s named staff as guests with MFA, uses a specific-people link only for a single file that cannot wait, and expires guest access on the contract end date.
Key takeaways
- A guest is a sign-in identity. A link is a grant on an object.
- Prefer guests or specific people over “anyone” for work files.
- Tenant settings limit what site owners can share.
- Remove guests when the work ends. PDPA-aware practice starts with least access.
FAQ
Does a guest need a Microsoft 365 licence in our tenant?
Usually no. They use their own identity. You are granting access, not buying them a staff licence. Unusual scenarios exist; do not licence a guest as if they were an employee without a reason.
Can we stop staff sending Anyone links?
Yes, at the tenant and often per site. Combine the setting with a short instruction: put team files in SharePoint, then invite guests.
Is emailing a file safer than sharing?
A copy in email is another copy you cannot revoke. A link you can expire is usually the better control, if “anyone” is turned off.