Teams and SharePoint: Checklist for Secure Sharing

External parties reach content in Microsoft 365 as a guest with their own account, via a sharing link, or in a shared Teams channel; via external access in Teams, they only chat, call, and meet. According to Microsoft, a new team also creates a Microsoft 365 group and a SharePoint team site, to which the guest sharing settings of groups and Teams apply. If Entra ID is more restrictive than SharePoint or OneDrive, Entra ID prevails.

• For the end of the SharePoint one-time passcode (the Entra B2B email one-time passcode remains), Microsoft advises: create a guest account with the same email address as for the old link, or share the item again; there are no exceptions. Check domain lists that exist only in SharePoint and transfer them to Entra ID if necessary.
• Microsoft Learn describes (as of October 2026) expiration policies for “People in your organization” links as well; existing links are checked against their creation date when opened.
• With a Copilot license (at least one person), SharePoint administrators receive, according to Microsoft, the Copilot-supporting features of SharePoint Advanced Management; some still require the Plan 1 add-on (Section 07).

You set the sharing level in the SharePoint admin center under Policies > Sharing, separately for SharePoint and OneDrive; OneDrive cannot be more permissive. According to Microsoft, external sharing is enabled by default. Per site (Active sites > site > Settings > More sharing settings), you can only make it stricter; the more restrictive value always applies. SharePoint administrators can change this, site owners cannot (exception: a label with a sharing setting, Section 06).

Default per site according to Microsoft: OneDrive and the root site (mandant.sharepoint.com) “Anyone”; group-connected sites, including those of Teams, “New and existing guests” if group owners are allowed to add external users, otherwise only existing guests; all others “Only people in your organization.”

According to Microsoft, guests usually lose access within one hour after a restriction; if sharing is turned back on, they regain it. According to Microsoft, confidential content belongs on sites without external sharing, and work with external parties belongs on separate sites.

Your tenant is responsible for guest MFA; you can trust the partner organization's MFA via cross-tenant access settings (trust settings, Entra ID P1). Blocked domains in external access do not block subdomains by default; Set-CsTenantFederationConfiguration -BlockAllSubdomains $True changes this.

Licenses according to Microsoft: guest access in Teams is included in Microsoft 365 Business Standard, Enterprise, and Education, with no additional license; the Entra External ID billing model applies to guests. Guests without a license only have basic collaboration, for example in Office on the web.

For the organization: configure once, document, and review at fixed intervals.

• Responsibility for changing sharing settings is clarified; there is a written rule on what may be shared with whom and through which channel.
• Settings from Section 03 implemented: sharing level chosen deliberately, default link “Specific people” with “View,” “Anyone” links off or with expiration, guest access expiration on.
• Settings from Section 04 implemented: guest invitations restricted, domain rules centrally in Entra ID, guest and external access in Teams set appropriately.
• Conditional Access policy with MFA for guests active and tested beforehand with test accounts.
• Sensitivity labels for teams, groups, and sites enabled, with at least one label without guests (Section 06).
• Earlier sharing with the SharePoint one-time passcode reviewed: anyone who still needs access has a guest account with the same email address.
• Expiration policy for groups, for example 180 days with a fallback address, and policy for ownerless groups set up (Section 08); when an owner leaves, the role is handed over beforehand.
• Monitoring scheduled (Section 07): monthly activity or sharing reports, quarterly permissions and the “Guest users” page in the Microsoft 365 admin center, guests reviewed and documented at project end and at defined intervals (Annex point 11.2.3 IR), these settings checked annually.
• Sharing and OneDrive content handed over when someone leaves; guest accounts deleted after a partnership ends.

For each team and site, before the first guest:

• Purpose and partner companies described; confidential content is in a separate team without external sharing.
• At least two owners from your own organization; team set to “Private” if not everyone should be able to read along; appropriate sensitivity label applied.
• Site sharing level: with guests “New and existing guests,” internal “Only people in your organization”; default link stricter than the organization's if needed.
• Sharing limited to the partners' domains (Advanced settings for external sharing > Limit sharing by domain) and guest access expiration adjusted to the project duration.
• Every guest has a responsible person. After being added to a team, access can take up to 12 hours; guests added directly to the group do not receive an invitation email, so someone from the team informs them.
• Members know: guests carry the label “(Guest),” and in jointly shared folders they see each other under “Manage access”; only what the guest needs is shared.
• At project end, guests removed and guest accounts no longer needed deleted; a guest who leaves the team remains in the directory.

Labels from Microsoft Purview in the “Groups & sites” scope define per team: privacy (public or private), external user access (whether owners may add guests), the site's external sharing level, access from unmanaged devices, and authentication contexts (both with Conditional Access). Microsoft also applies the team's label to the group and site.

1. 1

   Enable for containers

   Set EnableMIPLabels in Entra ID to True via Microsoft Graph PowerShell, then run Execute-AzureAdLabelSync in Security & Compliance PowerShell; it takes up to 24 hours until they are available in Entra ID.

2. 2

   Create labels

   “Groups & sites” scope. TOMORIS example: “Internal” (private, no guests, sharing within the organization only) and “Partner” (private, guests allowed, “New and existing guests”).

3. 3

   Test with a few people

   Publish to test accounts; for a new label, wait at least one hour (24 hours with shared channel controls), for a changed label 24 hours; create a team with it, then publish to everyone.

4. 4

   Label existing teams

   SharePoint admin center > Active sites: show the “Sensitivity” column, apply the label via the Policies tab; for many sites, use PowerShell.

According to Microsoft, files do not inherit the container's label; for that, there are labels for Office files in SharePoint and OneDrive. If the label controls external sharing, site owners can change it by switching the label; invited guests keep their access if “External user access” is turned off later.

Licenses according to Microsoft: at least one active Entra ID P1 license in the tenant; according to the Purview service description, manual labeling is included in Microsoft 365 Business Premium, E3, and E5, among others, automatic labeling only with E5 or Purview add-on licenses; authentication contexts via labels only with Microsoft 365 E5, Information Protection and Governance, or Office 365 E5.

Microsoft recommends the permissions report quarterly and activity reports monthly; without SharePoint Advanced Management, data collection must first be turned on. Base subscription according to the prerequisites page: Office 365 E3, E5, A5 or Microsoft 365 E1, E3, E5, A5; it does not list Business plans as a base subscription, so check in the admin center beforehand.

Common mistakes (compiled by TOMORIS): “Anyone with the link” as the default; “Anyone” links without expiration; sharing turned off and on again so that guests regain their access; only SharePoint restricted; confidential content and partner work on one site; container label mistaken for file protection; guests never reviewed.