External sharing in Office 365: Video and a comprehensive blog

Today’s users demand real-time collaboration, from any device, at any time. Naturally, this starts with being able to easily share documents. However, for IT heads, security, and admin leaders it also means keeping those documents – plus users and companies – secure.

That’s why we’ve created this webinar presentation for you. Andy Huneycutt, Microsoft 365 Collaboration Specialist and Microsoft MVP for Office Apps and Services takes you on a deep-dive into Office 365 external sharing settings. The content is for users through to admins, covering collaboration best practices through to sharing documents securely. And if you would prefer an eBook about External Sharing in Office 365, we’ve got you covered!

How external file sharing in Office 365 works

We recommend allowing users to create Teams, Microsoft 365 Groups and SharePoint sites as needed. That way it’s easier to scale, encourages self-service, and reduces the demands on your IT team.

Plus, users will always have a mixed way of using the Office 365 share file function. They may go through Outlook directly, where you can access your lists and libraries.

Also in Teams, where creating a Team means you create a site in SharePoint at the same time.

So you’re faced with the fact that sharing files in one location can mean sharing across connected groups, task lists, and even discussion boards. Policies and compliance will help you control, yet still enable, these self-service freedoms for users.

In Office apps such as Word and Excel, users may share a document or spreadsheet in Teams or SharePoint. Naturally, this method opens up many collaboration tools – such as commenting, co-authoring, and mentions.

SharePoint also provides shared libraries for team collaboration. Users may access these via OneDrive or Outlook.

Team or communication sites

These can comprise owners, members, security groups, visitors, or guests. You can connect sites through navigation, links, and even – to a certain extent – permissions.

Microsoft Teams

When you’re working with Teams, a SharePoint site is on the back end, along with shared tools. These will be split between owners (who control the site) and members or guests (who contribute to the site).

For site owner permissions in Teams, you’ll find a Microsoft 365 group nested underneath, which is where the sharing permissions originate. The result is that you may have some people working through Teams, without being added to Microsoft groups.

How to manage external sharing settings in Office 365

Office 365 external sharing settings are based on what permissions are defined in SharePoint groups. Members of a SharePoint permission group can be:

• Site visitors
  Can visit a site, but can’t edit
• Site members
  Have full control of the site
• Site owners
  Can modify site settings independently of other sites in the organization

Office 365 external sharing settings

Use the Share command to invite or grant permissions. This can include access to documents and files for collaboration.

By default, users can share files, folders, or even the site. Naturally, you have the option to limit this to site owners, with further control coming by adjusting site owner settings and having policies added to the admin center.

Files stored on SharePoint are usually available to everyone with permission to the site. However, you can still share Office 365 files and folders with people without giving access to the whole site, or having to spend time creating unique permissions for each file. What’s more, these permissions are dynamic, so you can stop sharing, remove links, or revert to default permissions.

When you’re in a SharePoint document library or OneDrive, hover over the file and you see different share commands, either to the right or at the top menu:

Sharing in Office

Open a file from an Office app and users also have multiple options for sharing. Naturally, this saves time because they can share while working within the app.

Sharing with the OneDrive Sync Client

You can share files from your OneDrive for work or school accounts. The advantage is that you can synchronize to your local machine to work with when offline. Any changes made will then sync into the cloud.

SharePoint offers the same functionality. When you’re working with a file on your local machine, you still have the option to share. You have this option in Teams too, with permissions coming from whatever you set for SharePoint and OneDrive.

Office 365 External Sharing feature

Teams and end-users have multiple options and features for collaborating on files, folders or content. For example:

• Anyone with the link
  Share the file with any user, internal and external. They can forward it and anyone can have the link and open it.
• People in your organization with the link
  This won’t work for partners, only works for people inside your internal organization who are already signed in.
• People with existing access
  People who already can access the file, or your site, or your Microsoft 365 group.
• Specific people
  Only people with the email addresses you specify can access the file. They’ll also have to authenticate by signing in.

Sharing Permissions

After you’ve chosen the link type, it’s time to decide on the permission levels:

• Allow editing
  Shared files are read-only by default.
• Open in review mode only
  For Word documents only, where users can add comments.
• Expiration date
  Admins and users can set this, however, a user can’t set an expiry date that exceeds what the admin has set.
• Block download
  Users can only open this online, not on desktop or mobile devices.

Sharing Visibility: Direct Access

End users can locate the file and click the three dots and then Details:

This shows who has access. You can change this by clicking Manage access:

Sharing as an Admin

Your end-users have multiple options for sharing files and folders. Of course, you can still put some policies controls in place, to limit what can be done. This can be done with:

• Azure AD
• Microsoft 365 guest group settings
• SharePoint organization-level settings
• SharePoint site-level settings

Let’s explore how to do this with Microsoft Groups. Head to Microsoft 365 admin center>Org settings>Services>Microsoft 365 Groups.

You’ll see access-level options for guests outside your organization. These settings also apply to Microsoft Teams. See this article on adding guests to Microsoft 365 groups for more details.

Sharing: The SharePoint admin center

Go to SharePoint admin center>Policies>Sharing.

Sharing rules: What to remember

Make sure to set permissions and restrictions in this order:

1. Microsoft 365 Group policies
2. SharePoint policies
3. Organizational-level
4. Site-level

Whatever you choose here will apply to SharePoint and OneDrive. You can control OneDrive settings independently, for example when lowering permissions.

However, changes in SharePoint will automatically affect OneDrive. So lowering permissions in SharePoint automatically lowers permissions in OneDrive. This article on turning external sharing on and off explains more about the potential impact on users.

Sharing best practices

• Store and share (instead of emailing attachments)
  Store your content on SharePoint/OneDrive/Teams and then share from there, to avoid duplication.
• Keep access to what’s necessary
  Restricting permissions helps users keep track of what’s happening with your content.
• Set expiry dates
  You can set these as default, to keep your files up-to-date and your storage system optimized.
• Set sharing at the site level
  You can also set permissions and restrictions per site, rather than per organization. Here’s how to change the external sharing setting for a site.

Microsoft 365 governance, analysis & auditing

As you can see, there’s plenty to consider when managing a Microsoft 365 environment. Staying on top of your inventory, controlling user access and permissions, tracking and preventing breaches – the list goes on. That’s where Syskit Point comes in.

You can automate Office 365 governance, delegate responsibility from IT teams to individual site/Teams/365 owners, and free up your resources for more strategic activities.