Skip to content

Control 4.4: Guest and External User Access Controls - Troubleshooting

This playbook provides troubleshooting guidance for Control 4.4.

Common Issues and Solutions

Issue Cause Solution
Cannot share with external users Tenant or site sharing disabled Verify sharing capability at tenant and site level; check if site inherits from tenant
Guest user cannot access content Conditional Access blocking Review CA policies for guest users; check named locations and device compliance
Sharing option grayed out Insufficient permissions or policy Confirm user has owner/member role; check if site allows non-owner sharing
External user link expired Automatic expiration configured Re-invite guest user; consider extending expiration period if business-justified
Domain blocked for sharing Domain restriction policy Add domain to allowed list if approved; document business justification

Additional Troubleshooting Steps

1. Verify Tenant Sharing Hierarchy

Site sharing cannot be more permissive than tenant settings.

# Check tenant vs site settings
$tenant = Get-SPOTenant
$site = Get-SPOSite -Identity "https://tenant.sharepoint.com/sites/SiteName"

Write-Host "Tenant sharing: $($tenant.SharingCapability)"
Write-Host "Site sharing: $($site.SharingCapability)"

# Site must be equal or more restrictive than tenant

2. Check Sensitivity Labels

Labels may block external sharing regardless of site settings.

# Verify if site has sensitivity label
Get-SPOSite -Identity "https://tenant.sharepoint.com/sites/SiteName" |
    Select-Object Url, SensitivityLabel

3. Review Conditional Access

Guest-specific policies may require MFA or compliant devices.

  • Navigate to Entra ID > Conditional Access > Policies
  • Look for policies targeting "Guest or external users"
  • Check for device compliance or location requirements

4. Audit Recent Changes

Use SharePoint Admin Center audit logs to identify configuration changes.

# Search audit logs for sharing changes
Search-UnifiedAuditLog -StartDate (Get-Date).AddDays(-7) -EndDate (Get-Date) `
    -RecordType SharePointSharingOperation -ResultSize 100

5. Test with Different User

Confirm issue is not user-specific permission problem.

Escalation Path

Issue Severity Escalation Path SLA
Sharing not working after 24 hours SharePoint Admin > Microsoft Support 2 business days
Unauthorized external access discovered Security Admin > Compliance > Legal Immediate
Conditional Access conflicts Entra Admin > Security Team 1 business day
Domain restriction issues SharePoint Admin Same day

Prevention Best Practices

  1. Document sharing settings before making changes
  2. Test in a pilot site before broad rollout
  3. Communicate changes to affected site owners
  4. Monitor sharing reports weekly for anomalies
  5. Review guest accounts quarterly for stale access
  6. Coordinate with Security for Conditional Access policies

Back to Control 4.4 | Portal Walkthrough | PowerShell Setup | Verification Testing

Updated: January 2026 | Version: v1.2