It's a common scenario: you've invited an external guest to your SharePoint site collection, but they're unable to access it, often encountering an "Access Denied" message or an inability to view content. This is a typical consequence of SharePoint's robust security measures designed to protect your intranet's information. While these barriers are essential for security, they sometimes inadvertently prevent guests from accessing shared resources.
The symptom
When an external guest cannot access a shared SharePoint site, they typically experience:
An "Access Denied" page after attempting to log in.
Inability to see content or navigate the site, even if they can reach the URL.
Prompts to request access, despite already being invited.
Why this happens
SharePoint Online implements external sharing settings at two critical levels:
Organization (Tenant) Level: This is the highest level of control, determining the maximum permissible sharing level across your entire Microsoft 365 tenant.
Site Collection Level: Individual site collections inherit the organization-level setting but can be configured to be more restrictive than the tenant policy, but never more permissive.
If the site collection's external sharing policy is set to a level that's too restrictive (e.g., "Existing guests only" or "Only people in your organization"), newly invited guests or even existing guests might be blocked from accessing the content.
The solution: adjusting Site Collection External Sharing settings
The most common solution involves adjusting the external sharing policy for the specific site collection to allow access for "New and existing guests."
Open the Microsoft 365 admin center.
In the left-hand navigation pane, click on "Show all" if necessary, then under "Admin centers," click on "SharePoint" to open the SharePoint admin center.
Click on "Active sites" under the "Sites" section.
In the list of active sites, click on the URL of the site collection that you want to share with external guests. This will open the site's details pane.
In the site details pane, click on the "Policies" tab.
Under "External sharing," click "Edit."
Choose "New and existing guests".
Click "Save".
Wait a few minutes for the changes to propagate.
If they still cannot access, you may try re-inviting the guest to the site collection. This can sometimes refresh their permissions and access token.
Understanding the Options:
Anyone: Allows unauthenticated users to access content (least restrictive).
New and existing guests: Allows sharing with new and existing external users who authenticate (recommended for most guest sharing).
Existing guests only: Only allows sharing with guests who are already in your organization's directory.
Only people in your organization: Disables external sharing for this site collection entirely (most restrictive).
Further troubleshooting tips
If the external guest still cannot access the site after following the above steps, consider these additional checks:
Check Organization-Level Sharing Settings: Ensure your overall SharePoint Online organization-level external sharing settings are not more restrictive than what you've set for the site collection. (SharePoint Admin Center > Policies > Sharing).
Verify Guest User in Azure AD: Confirm the guest user exists and is in a "Guest" status in your Azure Active Directory. (Microsoft 365 Admin Center > Users > Guest users).
Direct Permissions: After the external sharing is set, ensure the guest has been explicitly added to a SharePoint group (e.g., Members, Visitors) or given direct permissions on the site collection or the specific content they need to access.
Browser Cache: Advise the guest to clear their browser cache or try an incognito/private browser window.
By systematically checking these settings, you can effectively troubleshoot and resolve most external guest access issues in SharePoint Online.