Microsoft Entra B2B External Sharing: What Law Firms Need to Know

Should Every Client Be a Guest in Your Microsoft Directory?

Microsoft’s October 2026 updates to external sharing in SharePoint and OneDrive raise a practical question for law firms: which outside relationships need a guest identity, and which only need a secure way to exchange a file?

For years, one common way to share documents externally through SharePoint or OneDrive was simple: send a link, let the recipient verify their identity with a code delivered by email, and give them access to the document. In that model, the recipient didn’t need an account in your firm’s Microsoft directory.

That legacy sharing model is being retired. Two Microsoft updates in October clarify the timeline, what changes for existing users, and what law firms need to consider.

What changed in October

October 1: a revised schedule. Microsoft updated its Message Center announcement (MC1243549), first published in March 2026:

  • Phase 1 moved new external sharing to Microsoft Entra B2B. It is now fully rolled out in commercial production environments.
  • Phase 2 retires SharePoint Online’s legacy one-time passcode (OTP) authentication. It was rescheduled to begin in mid-October 2026 and is expected to finish by the end of November 2026.
  • Government clouds (GCC, GCC High and DoD) are excluded for now. Microsoft says it will announce its dates later.

October 7: an updated FAQ. Microsoft revised its FAQ on the change to explain what happens to existing links and external users. The FAQ still says the retirement happens “during October.” For timing, rely on the Message Center post and watch your own tenant’s Message Center.

The October 7 FAQ in brief

Will external users lose access to files we’ve already shared? Only some of them. External users who already have a matching Entra B2B guest account keep access. Those without one will get an access-denied message on older “Specific people” links once the change reaches your tenant.

Do we need to reshare every document? No. An administrator can create a guest account using the email address on the original link. Or, where the firm’s sharing policies allow it, someone with sharing rights can share at least one item with that person, which creates the account automatically. Once the account exists, the person’s earlier links work again.

Are email passcodes going away entirely? No. Only the SharePoint-specific OTP is being retired. When it’s enabled, Entra B2B email OTP still works as a backup sign-in method for guests.

Are “Anyone” links affected? No.

Can we opt out or choose our date? No. Commercial tenants are selected automatically, and the integration can’t be turned off.

How do we find affected users? At the site level, the external sharing report lists external users. Use it to find people who were invited with the old OTP and don’t have a matching guest account.

These details matter. Microsoft isn’t making file sharing harder for the sake of it. It is deliberately moving to one identity system with consistent governance. The real question is how that model fits the way law firms work.

A guest identity is not the same as access

It helps to be precise here. A guest account in Entra B2B doesn’t give someone broad access to your Microsoft environment. A guest can only reach what they’ve been permitted to reach.

The transition changes how external users are authenticated and represented in your directory. What they can access still depends on the permissions assigned to them. But managing those identities creates its own responsibilities. Every guest identity should have a clear purpose, appropriate access controls, and a process for reviewing or removing it when the relationship ends.

Not every external relationship is the same

Think about the outside people involved in a typical matter. Co-counsel may work on documents with you for months. A client reviews a draft agreement. An expert receives discovery materials. Opposing counsel receives a production.

All of them are external, but they need different things. For co-counsel working alongside your lawyers in Teams or SharePoint, an ongoing guest identity makes sense. The firm can apply the right authentication, access controls, and reviews for the whole relationship.

The expert who needs one document, or the client who only needs to return a signed agreement, is a different case. The question isn’t whether these exchanges should be secure. It’s whether every occasional exchange should create a guest identity that the firm then needs to manage.

The governance question

Entra B2B makes stronger identity governance possible. It also adds work. A firm that exchanges documents with many clients, experts and vendors can build up a large number of guest accounts over time.

That leads to practical questions:

  • Who owns a guest account after the matter closes?
  • Should guest access expire automatically?
  • How do you tell an active collaborator from someone who received one document eighteen months ago?

Across hundreds or thousands of matters, these questions add up. The technology isn’t the hard part. The hard part is making governance keep up with how lawyers and clients actually share information.

Security policies are part of the client experience

With one identity system, firms can apply the same security policies to external users. That’s a real advantage. But a policy that suits employees or frequent collaborators may not suit someone who opens a single document.

Picture a general counsel reviewing an agreement while travelling, or an expert opening a file an hour before a filing deadline. A second sign-in prompt, a mismatched email address, or an unfamiliar sign-in screen can stop them at the worst possible moment.

This problem isn’t unique to Microsoft. Legal technology is always balancing security against ease of use. Security controls should protect confidential information without getting in the way of the people who are authorized to use it.

Collaboration and file exchange are different workflows

Collaboration usually means ongoing access to shared workspaces, documents, and conversations. Confidential file exchange is often simpler: one person needs to send or receive specific information securely.

Both need strong security. They don’t always need the same tools, permissions, or identity lifecycle.

For firms invested in Microsoft 365, Entra B2B gives a consistent way to manage outside collaborators. Other workflows, especially one-time or occasional exchanges, may be better served by a separate secure process that doesn’t add every recipient to the firm’s directory.

These approaches can work side by side. The goal is to match the process to the relationship, rather than expect one sharing model to handle every outside interaction.

Five questions for law firm technology leaders

1. Do we know who has access today? Run the external sharing reports and find recipients without matching guest accounts. Pay closest attention to older links that active matters still depend on.

2. How will we manage the guest lifecycle? Decide who approves guest access, who reviews it, and what happens when a matter or relationship ends.

3. Do our security policies suit occasional recipients? Look at your authentication and Conditional Access settings from the point of view of clients, experts, and other outside users.

4. Do we treat collaboration and file exchange differently? Consider whether long-term collaborators and one-time recipients should follow different processes, while keeping the right controls on both.

5. Have we tested what clients actually experience? Ask someone outside the firm to open a confidential document, sign in, and send something back using your approved process. You may learn more from that test than from another review of admin settings.

The bigger question

Microsoft’s move to Entra B2B is a meaningful change in how organizations manage external access. For law firms, it’s an opportunity to reassess how they collaborate with clients and other external parties.

Not every client needs the same access. Not every matter needs a shared workspace. And not every confidential exchange needs to create a new identity in your directory.

The goal isn’t to avoid guest accounts. It’s to use them deliberately.

Microsoft’s October changes are about identity management. For law firms, the bigger conversation is about client experience. The firms that get this right will do more than manage external access effectively. They’ll make secure collaboration easier for everyone involved.

Sources