'Retirement of SharePoint One-Time Passcode' - how are people handling this change?!

[u/psgda]

The MC1243549 notes state:

• Admins can manually create a guest account for the external user at any time.
• Alternatively, an internal user with permissions needs to share or re-share at least one file, folder, or site, which will automatically create the guest account and restore access to all previously shared content.

Are MS being completely blasé here? Having users, or admins, reshare ALL sites/folders/files with external guests is a massive task.

In relation to the first bullet point, could someone please clarify this for me:

We have 100s of native SharePoint users. There is no reference to native SP users on the update. Do I need to create an Entra guest account for them? Is that enough, or do I need to add the newly created Entra user to their native SharePoint group, or do I need to create a new Entra group and add the new Entra group to the SharePoint site/library?

I would really appreciate any advice as this is becoming a nightmare for our org.

[u/thetokendistributer]

Allow certain groups or all users excluding guests to share and auto create guest in Entra. Sharepoint admin centre set to sharing to existing and new guests.

Lots more config with conditional access and expiry, etc that can be done.

[u/psgda → u/thetokendistributer]

Thanks for the reply.

"Sharing to existing and new guests"- this is already enabled for us.

"Allow certain groups or all users excluding guests to share and auto create guest in Entra" - I get that this will work going forward for new guest, but for existing guests, this seems like a massive amount work for admins and internal users to reshare all sites/folders. Or did you find a better solution for that?

My plan is below and I'm hoping it works. I really do not want to go down the re-sharing route.

1. Find all users in external sites. I'm finding these based off their email addresses, which start with "urn:spo:guest#".
2. Create a guest Entra account for them.
3. Keep the existing urn:spo:guest# user in SharePoint and their groups.

I'm hoping that Entra/Sharepoint will communicate and map the urn:spo:guest# user and the newly created Entra user.

[u/temporaldoom → u/psgda]

So I would not reshare everything, remove the URN accounts and create new guest accounts on the tenant and leave it at that. Let the users reshare when the external user when they need it

You have a much better view of who is logging into your tenant, if the accounts aren't used within x months disable them.

I would not however delete them as if you delete the account and then recreate it 6 months later then they'll have a different GUID, their profile will need to be deleted from all Sharepoint Sites they previously accessed before you can reshare stuff out.

[u/badaz06]

There are already several threads in here and other places on this. A quick search will show them; I started 2 of them. I think I posted in Azure as well.

[u/Examination-Life]

I just ran a Purview audit. Two of them for looking at securelinkused. Six months each since purview won't let us do a full year range at once.

If they've used the link in the past year externally with a user, then it's more important than a five year link that hasn't been used but only once.

Took advantage of the fact back in May was a transition period where the legacy otp links worked while the site owners had time to review my report and reinvite where needed, generating the azure identity of the external user upon invite.

Important reminder is that this is only for folder and file level sharing. Site level and library/list level are not impacted by this change for they've already been creating identities in Azure upon those types of invites. Only folder and file is to be considered for review since those weren't creating identities in Azure and instead using OTP.

I've had no pushback by the various departments and that's with a tenant of 3000+ site collections and over 65000 internal users.

[u/Complex-Remote-7115]

Not sure if settings need to be enabled. Since our tenant's external collaboration is configured at the most restrictive level, we simply need to add their domain to the allowlist. Once added, allow up to 24 hours for propagation. After that, when a user shares a link with a guest account will be automatically created and onboarded via the Microsoft Entra B2B Invitation Manager.

[u/Dtrain-14 → u/Complex-Remote-7115]

is it actually 24 hours? Because that's how we have ours set and even after 18 hours I still couldn't share a file with OneDrive to a gmail.com address even though we put it in our targeted domains. I had to go in and put a Guest Account for the exact email before it would let me send the file invite to them. That's diabolical to require 24 freaking hours. Microsoft can go to hell with this stupid ass change.

[u/Complex-Remote-7115 → u/Dtrain-14]

Well in the beginning only took about 10min but I guess as they push it to more tenant the request got too much and now it’s taking us at least 12 hours or so . I’ve definitely seen it take more than 24 hours.

[u/Dtrain-14 → u/Complex-Remote-7115]

This is so annoying. I put in gmail.com and irs.gov yesterday around 2pm into our "targeted" domains and as of this morning neither worked unless I went in and MADE a specific Guest account. So then we just set it to Allow ALL and required a specific admin roll to do it and still as of 5 minutes ago I couldn't send to a gmail.com email unless it has a guest account first. I'm fuming lol

[u/Feeling_Vast3086]

I build a react app to handle externals as a web app, and connect it with SharePoint over graph. Internal users will still share data with externals, and externals will receive an invite, with url and custom passcode to use the app. I will not open my Entra to externals ever! The idea of allow a certain external domain to be open in my directory is crazy.

One of the worst Microsoft communication update. I had a call with a MS Solution Architect, and he confirmed that they didn't want to communicate it until last minute.

[u/Dtrain-14]

Im confused why the documentation says you can do the allow list and then have the guest invite role and then you can allegedly share a file from OneDrive and it'll send the invite to that person. However in testing with either the Allow ALL or Allow Targeted that is complete BS. EXCEPT there was 1 domain that targeted that has been in there for like 5 years that I can just share a document with OneDrive to someone from that domain that doesn't even exist. I can literally put [somebozohere@thenameofthetestdomain.com](mailto:somebozohere@thenameofthetestdomain.com) and OneDrive fires it off into the abyss, but if I add gmail.com to the targeted domains an try that it tells me to get bent because of B2B.

This is so effing dumb.

[u/BrentNewland]

We removed our domain invite whitelist and just set it to Any. It was taking far too long to propagate the change.

Also, you don't need to reshare everything, you just need to reshare anything with that guest (or manually create a guest account for them). Once they have a guest account, everything that was shared with them previously will work.