Collaborate with external parties in Office 365 and what you need to know about licenses
In this article I will discuss collaboration with Microsoft Teams, SharePoint and OneDrive. There is a lot of uncertainty about how you can collaborate with external parties in Microsoft Teams, SharePoint or OneDrive. And then I am specifically talking about the license part. In general, external sharing is free. That is good news. There are only differences between the different ways of external sharing.
If you read Microsoft’s blogs, it often says that it is a ratio of 1 to 5. This means that you can invite 5 users per license in your Office 365 environment. This does depend on the type of license. For example, if you only use Office 365 and no Azure Premium (most people do not know what this is/does), then you can share unlimitedly. So then that limit does not apply. If you turn on Azure Premium, for example because you want to do naming in SharePoint sites or because you want to set a condition for sharing, then this does apply. More about Azure Premium later.
How does external sharing work technically?
External sharing in Microsoft Teams, SharePoint Online, and OneDrive adds users. This happens after the user accepts their invitation. Before the invitation is accepted, you will not see the user in the Azure AD portal. If another site invites a user in the meantime, a new invitation is generated. This process is not limited by the number of Office 365 licenses.
Restrictions for externals
However, there are limitations on the functionality they are given:
They can perform tasks on a site that correspond to the rights they have been given. For example, if you add an external user to the Members group, they will have editing rights and can add, edit, and delete lists. They can also view, add, update, and delete list items and documents.
They can use Office Online to view and edit documents. If your subscription includes Office Professional Plus, the external user will not be able to install the desktop version of Office on their computer unless you assign them a license.
They can see other content from the sites. Depending on the permissions you have given them. For example, they can navigate to different subsites and within the site collection they’ve been invited to. They can also do things like view site feeds.
More info here.
If external users need more features, dan dat ze nu als externe krijgen, dan moet je een licentie kopen en deze toewijzen, zodat ze dezelfde functies krijgen als interne gebruiken.
Anonymous Links
Please note that when you have the standard options enabled, people can also create links and share them with the entire world. These are the anonymous links. It is advisable to disable these. You can do this in the admin center. (“https://tenant-admin.sharepoint.com/_layouts/15/online/AdminHome.aspx#/sharing”) You can also specify here how long a link will remain or whether users must log in with the same email address from the invitation. This improves the standard security and gives you control over it.
Comprehensive security when collaborating
You can tighten up security. As a security company, Microsoft also offers many extras in Azure, such as Multi-Factor Authentication (MFA), Azure Information Protection (AIP) or Intune for Mobile Device Management (MDM).
When you want to share content with external users with Azure B2B collaboration, users are added immediately via the invitation. They appear everywhere and can also be selected in Microsoft Teams, SharePoint Online and OneDrive.
This service for Office 365 collaboration is also free with the free Azure options. However, if you want to give B2B users access to paid Azure AD functions, you must have sufficient licenses to support those B2B guest users. Someone with an Azure AD tenant gets 5 extra B2B guest licenses per paid Azure license. Therefore, depending on the paid Azure AD features for guest users, you must have enough paid Azure AD licenses for B2B collaboration users in a 5:1 ratio.
For example, if you want to invite 50 external users, all of whom need Azure MFA, you must have at least 10 Azure licenses for MFA (AAD P1 / P2). More examples can be found here .
Conclusion
Now I hear you thinking how complicated is this? It is. The 5:1 ratio only applies to Office 365 groups and Microsoft Teams. And therefore not when you share a file directly from SharePoint or OneDrive. It is important that the person does not participate in the group. So for example in a separate rights group. At that time, infinite sharing with external users still applies.
If the person participates in the group conversations, he falls under the 5:1 ratio, provided of course that Azure Premium is enabled.