Enable SharePoint and OneDrive integration with Microsoft Entra B2B

Description

External sharing from SharePoint and OneDrive goes through Microsoft Entra B2B: every external recipient of a file, folder or site gets a guest account in the directory (EnableAzureADB2BIntegration is True). Guests who cannot use another method sign in with the Entra B2B email one-time passcode.

Between May and July 2026 Microsoft turned this integration on for new external sharing in all commercial tenants and removed the ability to turn it off. The control is then met by default; the check remains useful for tenants where the setting still applies and to confirm the state.

Rationale

Without the integration, people who receive a file link authenticate with a SharePoint-only one-time passcode and never appear as directory objects. Entra guest invitation restrictions, domain allow and deny lists, Conditional Access (MFA for guests), access reviews and guest expiration do not apply to them. With B2B, every external person is a directory object that these controls govern, and sign-in is bound to the invited identity.

Impact

Each external recipient gets a guest account, so the guest count in Entra grows. Entra external collaboration settings (who can invite, allowed domains) now also restrict file and folder sharing: review them first. Microsoft retires SharePoint one-time passcode authentication for commercial tenants in October 2026; external people without a matching guest account lose access to earlier Specific people links until they are invited again.

Setting

Audit

1. As a SharePoint Administrator (no read-only role exists for the SharePoint Online Management Shell), connect with Connect-SPOService and run Get-SPOTenant | Select-Object EnableAzureADB2BIntegration.
2. In a commercial tenant, the integration is enforced regardless of the value; confirm it by sharing a test file with an external address and checking in the Microsoft Entra admin center (Entra ID > Users, filter User type = Guest) that a guest account was created.
3. Fail if the property is False in a tenant where the setting still controls sharing (for example a sovereign or government cloud).

Remediation

1. Review the Microsoft Entra external collaboration settings (Entra ID > External Identities > External collaboration settings): guest invite restrictions and allowed or blocked domains. Move SharePoint domain restrictions there if needed.
2. As a SharePoint Administrator, run Set-SPOTenant -EnableAzureADB2BIntegration $true.
3. Before the SharePoint one-time passcode retirement reaches the tenant, create guest accounts for external people who still need earlier links (Entra Users > Invite external user), or reshare one item with them.

References

• Microsoft Entra B2B integration for SharePoint & OneDrive Microsoft, vendor-doc, accessed 2026-10-24
• Manage sharing settings for SharePoint and OneDrive in Microsoft 365 Microsoft, vendor-doc, accessed 2026-10-24
• Set-SPOTenant (SharePoint Online Management Shell) Microsoft, vendor-doc, accessed 2026-10-24

Mappings

How this control relates to the other framework's: equivalent, stricter, looser, partial or related.

Threats mitigated

Related controls

• related CB-M365-COLLAB-003 Restrict SharePoint external sharing to authenticated guests
• related CB-M365-COLLAB-005 Limit SharePoint and OneDrive external sharing to approved domains With B2B integration, the Entra domain allow list also applies.
• related CB-M365-COLLAB-011 Expire guest access to sites and OneDrive automatically
• related CB-M365-COLLAB-012 Require people who use a verification code to reauthenticate regularly With B2B integration, Entra session controls replace this setting.
• related CB-M365-TENANT-011 Restrict guest invitations to administrators and Guest Inviters
• related CB-M365-TENANT-012 Allow guest invitations only to approved domains

People and lifecycle