Insights

Microsoft is making a significant change to how SharePoint and OneDrive handle external sharing, and if your organisation regularly shares files or folders with people outside your business, this is worth paying attention to.

What is changing with SharePoint sharing, and why?

Until now, when you shared a file or folder in SharePoint or OneDrive with someone outside your organisation, Microsoft used a method called SharePoint B2B. This typically sent the recipient a one-time passcode (OTP) by email, which they used to access the content. It worked, but it had real limitations. There was no way to govern or audit that access in any meaningful way, and it sat completely outside the security controls that IT teams rely on.

From May 2026, Microsoft is switching all tenants over to Entra ID B2B Collaboration (previously known as Azure Active Directory B2B). Under this approach, when you share content with an external person, a guest account is automatically created for them in your Microsoft Entra ID directory. That guest account can then be managed, monitored, and controlled like any other identity in your environment, with Conditional Access policies, auditing, and governance all available to you.

The retirement of the old OTP-based method will be complete across all Microsoft 365 environments by 31 August 2026.

Why this is a better approach?

This change is genuinely good news for security and governance. A one-time passcode does the job in the moment, but once it has been used, you have no ongoing visibility of who has access to what. With Entra guest accounts, you can see exactly who has access to your shared content, enforce policies around that access, and revoke it when it is no longer needed.

For organisations that take data governance seriously, this is a meaningful step forward.

The disruption to watch out for

Any sharing links that were created using the old OTP method will stop working when the retirement takes effect in July 2026. External users who try to access those links will see an error message saying “This organisation has updated its guest access settings.”

The fix is straightforward but requires effort: you will need to re-share the relevant files, folders, or sites with those external users. When you do, Entra will automatically create a guest account for them and access will be restored.

If your organisation shares a lot of content externally and has not already made the switch to Entra B2B, there could be a reasonable volume of links that need attention. Getting ahead of this now is far better than dealing with frustrated external contacts in July.

Key dates

• May 2026: New external sharing invitations will use Entra B2B guest accounts by default. OTP links created before this point will continue to work for now.
• July 2026: Existing OTP-based links will begin to fail.
• 31 August 2026: Full retirement across all Microsoft 365 environments, including commercial, government, and sovereign clouds.

What you should do now

1. Get a picture of your current external sharing. It is possible to run a report that shows all currently active shared links in SharePoint and OneDrive. Because this report will contain information about shared data, we make it available on request. You can also retrieve it yourself if you have admin access, following Microsoft’s guidance here.
2. Review and prioritise. Once you have the report, go through it with the relevant content owners. Work out which shared items are still actively needed by external users, and which can simply be left to expire.
3. Re-share where needed. For anything still in active use, re-share it with the external users who need access. This will create their Entra guest account automatically and restore their access cleanly.
4. Use this as a governance opportunity. This is a good moment to take stock of who has access to your shared data more broadly. Access should only exist for people who need it, for as long as they need it. A tidy-up now will put you in a much stronger position going forward.