Security/MFA on Sharepoint links

Question

Security/MFA on Sharepoint links

Dilan Spouse 0

We are having massive problems getting clients to be able open documents using authenticator. The account registration process is severely inhibiting our ability to comunicate with our clients in a secure way. This is not only impacting our business but literally 100's of financial businesses in our group. A simple solution from our perspective would be a personalised authenticator (supported by microsoft) that allows us to specify users so we can text them a link on their phones or email their PC (maybe with a one time manual code from us) and then have a limited authenticator work on their phone. Noting I'm not a techo so there may be better ways.

What is easy for a technology developer is not so easy for a 70 or 80 yo who is not in our office when they try an open the links. This is causing significant interuption to our business and material frustration with clients and other professionals such as accountants.

0 comments

2 answers

Your answer

Answer 1

For secure, low-friction client access, share documents with Specific people and use Microsoft Entra B2B email one-time passcodes, then have your administrator review any Conditional Access policy that separately forces clients to register Microsoft Authenticator.

Clients without a Microsoft, work, or school account can receive a temporary code at the same email address to which the document was shared. They do not need a personalized Authenticator app or a Microsoft account. ^1^

Recommended setup

A Microsoft 365 or Entra administrator should:

Open the Microsoft Entra admin center.
Go to Entra ID → External Identities → All identity providers.
On the Built-in tab, select Configured beside Email one-time passcode.
Set Email one-time passcode for guests to Yes, and select Save.

This requires at least the Authentication Policy Administrator role. Email OTP is already enabled by default unless it was explicitly disabled. ^1^

Then share each document as follows:

In SharePoint, select the document and choose Share.
Open Link settings.
Select Specific people.
Enter the client’s exact email address and send the invitation.
The client opens the link, selects Send code, retrieves the code from email, and enters it in the browser.

The code is valid for 30 minutes. The authenticated session expires after 24 hours, after which another emailed code is required. ^1^

For commercial tenants, SharePoint and OneDrive integration with Entra B2B is already enabled for new external sharing. Entra B2B email OTP remains supported as SharePoint’s older OTP mechanism is retired. ^2^

If clients are still asked to install Authenticator

An email verification code and MFA are separate controls:

Email OTP verifies ownership of the invited email address.
A second Microsoft Authenticator registration prompt normally means an Entra Conditional Access policy also requires MFA for guest or external users.

Have the Entra administrator inspect Entra ID → Conditional Access → Policies for policies targeting:

Guest or external users
SharePoint, Office 365, or all cloud apps
A grant control requiring MFA or an authentication strength

Do not simply disable MFA across the tenant. Instead, decide which of these designs meets the organization’s security and regulatory requirements:

Email OTP without an additional guest MFA challenge
Adjust the guest Conditional Access scope if the business’s risk and compliance requirements permit it. Email OTP users cannot be targeted with Conditional Access authentication-strength policies; where MFA is required for them, the Require multifactor authentication grant control applies. ^3^
Trust MFA completed by professional partners
For accountants and other clients whose organizations use Microsoft Entra, configure inbound cross-tenant trust. In Entra ID → External Identities → Cross-tenant access settings, add the partner organization, open its inbound Trust settings, and enable Trust multifactor authentication from Microsoft Entra tenants. Their existing organizational MFA can then satisfy your policy instead of requiring registration in your tenant. ^4^

Cross-tenant MFA trust applies to clients authenticating through another Microsoft Entra organization; it does not solve access for ordinary personal email accounts.

Avoid issuing codes manually

The documented SharePoint/Entra model does not provide a business-branded, limited Authenticator in which staff manually issue clients a code. The supported low-friction mechanism is for Microsoft Entra to send the one-time code directly to the invited email address. Staff-created codes would also weaken the proof that the person opening the link controls that mailbox.

“Anyone with the link” alternative

If the documents are not sensitive and organizational policy permits anonymous access, Anyone links remove authentication entirely. However, forwarded links also work for other people, and SharePoint cannot identify who accessed the item. This option is therefore unsuitable for most confidential financial documents. It can be enabled or restricted under SharePoint admin center → Policies → Sharing. ^5^

Test the final configuration with one new external email address that has never redeemed an invitation. Existing guests can retain the authentication method used during their original redemption, so a new test user gives a clearer result. ^1^

References

Answer 2

Hi @Dilan Spouse,

I understand your concern. Requiring clients, particularly those who may be less familiar with technology, to register and use an authentication app can make the external sharing process difficult and significantly disrupt communication.

A custom or personalized version of Microsoft Authenticator is not currently a supported SharePoint option. However, your administrator can review whether Microsoft Entra B2B email one-time passcode authentication is available for your external users. With this method, an eligible guest can receive a temporary code at the email address to which the document was shared, rather than having to create a new Microsoft account.

Please note that email one-time passcode is a sign-in method. It may not satisfy or replace an additional MFA requirement imposed by your organization’s Conditional Access policies.

When sharing a document, select Specific people and enter the client’s exact email address. If clients are still being required to register Microsoft Authenticator, your Microsoft 365 administrator should review the tenant’s Conditional Access policies, particularly any policy requiring MFA for guest or external users.

Because your organization handles financial information, broadly disabling MFA would not be advisable. Instead, the administrator should assess whether the policy can be scoped more appropriately based on the guest users, cloud application, or sensitivity of the information.

If some external users sign in with accounts managed by another Microsoft Entra ID organization, the administrator can also evaluate cross-tenant MFA trust. This can allow MFA completed in the users’ home tenant to be accepted by your resource tenant. This option does not apply in the same way to users who authenticate through email one-time passcode or personal email accounts.

For more information, see:

If you encounter any difficulties or need further clarification, your Microsoft 365 administrator can open a support request through Help & support in the Microsoft 365 admin center. A Microsoft Support engineer can review the relevant configuration and, where appropriate, arrange a remote support session to help guide you through the issue.

I hope this helps clarify the available approaches.