Conditional Access Problems

Fix External Users Blocked from SharePoint by Conditional Access

Natalie Taylor Oct 19, 2026 869 views

Question details

External users receive a SharePoint sharing invitation but are unable to access the files due to conditional access criteria restrictions.

Fix External Users Blocked from SharePoint by Conditional Access Policies

Product: Microsoft SharePoint / Microsoft Entra ID
Device & OS: not provided
Scenario: An external guest user attempts to open a shared SharePoint file but gets blocked by an organizational location policy.
Observed behavior: The user receives a one-time passcode but is denied access with a message indicating their sign-in does not meet the criteria to access the resource.

Before you start

Ensure you have Microsoft Entra ID (formerly Azure AD) or Intune administrator privileges to view and modify Conditional Access policies and sign-in logs.

Solution 1Recommended

Create a Scoped Policy Exception for Guest Users

Modify your Microsoft Entra ID Conditional Access policies to allow trusted external users to access resources from outside your standard approved locations.

Instead of disabling the location policy globally, the best practice is to create a carefully scoped exception specifically for guest accounts or trusted external collaboration scenarios.

Access Conditional Access policies

Log in to the Microsoft Entra admin center as a Conditional Access Administrator and navigate to Protection > Conditional Access > Policies to review existing location-based restrictions.

Select the blocking policy

Click on the policy that restricts access by location. Under the 'Users' assignment, switch to the 'Exclude' tab.

Exclude external users

Select the checkbox for 'Guest or external users' to bypass the location restriction for invited external collaborators.

Save and verify

Save the updated policy and review the Entra ID sign-in logs with a test guest account to confirm the block is lifted.

Create a Scoped Policy Exception for Guest Users

Maintain Security: Ensure that other security requirements, such as Multifactor Authentication (MFA), remain enabled for guest users even if location restrictions are bypassed.

Solution 2

Review Sign-In Logs to Identify the Blocking Policy

Use Entra ID logs to pinpoint the exact Conditional Access policy causing the access failure before making changes.

Free Microsoft Office alternative

Discover WPS Office: A Powerful and Free Alternative for Document Collaboration

If managing complex Microsoft 365 policies like SharePoint Conditional Access is slowing down your external collaboration, consider WPS Office. It provides a lightweight, highly compatible alternative for creating, editing, and sharing documents effortlessly without restrictive infrastructure configurations.

Highly compatible with Microsoft Word, Excel, and PowerPoint formats.Lightweight installation with a familiar, easy-to-use user interface.Free to use for everyday document creation and offline collaboration.Seamlessly transition without the hassle of complex Entra ID policies.

microsoft office alternative - wps office

Frequently Asked Questions

Why do external users get blocked even after entering the one-time passcode?

The one-time passcode only authenticates the user's identity. Once authenticated, Microsoft Entra ID applies Conditional Access policies, which may still block the user if they are signing in from an unapproved geographic location according to your organization's rules.

Can I disable location policies just for a specific SharePoint site?

Conditional Access policies can be scoped to target specific cloud apps, including SharePoint Online. However, it is usually more effective and secure to scope the exclusion to 'Guest or external users' rather than leaving an entire application or site unprotected.

How do I securely share files without modifying my organization's location policies?

If you cannot change the Entra ID location policies, the external user must access the files from an approved location. This can sometimes be achieved via a company-approved VPN that routes their web traffic through a permitted country like the US or Canada.

Microsoft Office Security Issues