Microsoft is changing how SharePoint and OneDrive external sharing works, and it is worth a calm review for small businesses that regularly share files with clients, vendors, bookkeepers, attorneys, contractors, or partner organizations.
In a Microsoft Learn article last updated May 7, 2026, Microsoft says that starting in May 2026, SharePoint and OneDrive integration with Microsoft Entra B2B is being enabled for all tenants. Microsoft also notes that once the rollout applies, the old tenant setting for disabling that integration no longer controls sharing behavior. The original Microsoft guidance is here: SharePoint and OneDrive integration with Microsoft Entra B2B.
This is not a reason to panic. It is a reason to ask better questions about who can access company files, how outside users are managed, and whether old sharing practices still match the business risk.
What is changing?
SharePoint and OneDrive have supported different external sharing models. With Microsoft Entra B2B integration, outside users are represented as guests in Microsoft Entra ID, and Microsoft Entra external collaboration settings can apply to those guest users. Microsoft describes this as bringing external sharing under Entra policies such as guest invite settings, collaboration restrictions, and access controls.
That can be a security improvement because guest access becomes easier to govern centrally. It can also create friction if a business has old shared links, inconsistent guest accounts, or unclear rules about who is allowed to invite external collaborators.
Why business owners should care
Many small offices use Microsoft 365 file sharing as part of everyday operations. A legal office may share client documents. A healthcare practice may exchange administrative files with vendors. A construction, finance, or professional services firm may have folders shared with outside partners for months or years.
The business impact is practical: some outside users may need to be reshared access, guest access rules may become more important, and old assumptions about sharing links may no longer be accurate. If nobody owns that review, file access can become either too loose or too frustrating.
What to ask your IT provider
Before approving a rushed Microsoft 365 change or ignoring the update entirely, ask for a short review of the current sharing setup:
- Is external sharing turned on only where the business actually needs it?
- Who is allowed to invite outside users?
- Are guest users reviewed and removed when they no longer need access?
- Are sensitive SharePoint sites blocked from external sharing?
- Do Entra guest policies, MFA requirements, and allowed or blocked domains match the business need?
- Are there important client, vendor, or partner folders that may need resharing because of the change?
- Can the provider show audit logs or reports for external sharing activity?
Microsoft's external sharing overview also points out that SharePoint and OneDrive external sharing should be part of overall permissions planning. That matters because a setting that is convenient for one department may be inappropriate for another. The supporting Microsoft overview is here: Overview of external sharing in SharePoint and OneDrive.
Do not turn this into a tool-buying exercise first
The first step is not automatically buying another security product. The first step is knowing the current state: who is shared, what is shared, which sites allow outside access, and whether those choices are documented. Some businesses may need a policy cleanup. Others may need staff guidance. A few may need stronger controls around sensitive data.
A good Microsoft 365 review should separate urgent fixes from normal housekeeping. For example, a stale guest account with broad access to sensitive folders deserves faster attention than a low-risk vendor folder with a clear owner and expiration process.
Where Tekmyster fits
Tekmyster can help review Microsoft 365 sharing and guest access from an independent advisory perspective. That means looking at the business workflow first, then checking whether the tenant settings, site permissions, vendor recommendations, and user process make sense together.
If your IT provider recommends changes because of this Microsoft update, it is reasonable to ask for a plain-English explanation before approving the work. A short independent review can help confirm whether the recommendation reduces risk, avoids unnecessary disruption, and fits how the business actually collaborates.
Sources and further reading