Conditional Access Problems

Fix Guest Sync Issues for SharePoint and Teams Libraries with MFA Enabled

Aamir Naveed Akram Sep 28, 2026 870 views

Question details

Guest users are unable to sync SharePoint or Teams document libraries using OneDrive because a Conditional Access policy requires multifactor authentication.

How to Fix SharePoint and Teams Library Sync for Guests with MFA

Product: Microsoft 365 (SharePoint, Teams, OneDrive)
Device & OS: not provided
Scenario: External B2B guest users are attempting to sync shared SharePoint or Teams document libraries to their local devices using the OneDrive sync client.
Observed behavior: The synchronization process fails or is blocked because the Microsoft 365 Conditional Access policy enforces MFA for the entire Office 365 apps group, preventing the OneDrive client from successfully authenticating the external user.

Before you start

Ensure you have Global Administrator or Conditional Access Administrator privileges in the Microsoft Entra ID (formerly Azure AD) tenant to view and modify security policies. Modifying these policies can impact tenant-wide security, so proceed with caution.

Solution 1Recommended

Target Individual Applications in Conditional Access

Adjust the Conditional Access policy to target specific apps rather than the entire Office 365 suite, allowing OneDrive and SharePoint to bypass the strict MFA requirement for guests if security permits.

When a Conditional Access policy targets the 'Office 365' app group as a whole, OneDrive cannot be excluded individually. By reconfiguring the policy to target individual applications, you can exclude SharePoint Online and OneDrive for guest users while keeping MFA enforced for other critical services.

Access Conditional Access Policies

Log in to the Microsoft Entra admin center as a Conditional Access Administrator. Navigate to 'Protection' > 'Conditional Access' > 'Policies'.

Select the Affecting Policy

Locate and click on the specific Conditional Access policy that enforces multifactor authentication (MFA) for guest or external users.

Modify Target Resources

Under 'Target resources', change the selection from the broader 'Office 365' app group to 'Select apps'.

Select Specific Apps

Manually add the individual applications that require MFA for guests, making sure to omit or exclude 'SharePoint Online' (which also covers Teams files and OneDrive) from the enforced list.

Save and Test

Click 'Save' to apply the policy changes. Wait a few minutes for the policy to propagate, then have a guest user restart their OneDrive sync client to test the B2B library synchronization.

Target Individual Applications in Conditional Access

Security Consideration: Excluding SharePoint and OneDrive from MFA policies reduces security for your shared files. Always assess the organizational risk and review Microsoft's B2B Sync guidance before implementing this workaround.

Solution 2

Temporarily Exclude Specific Guest Users from MFA (Not Recommended)

If restructuring apps in your Conditional Access policy is not feasible, you can exclude specific guest accounts from the MFA policy entirely, though this reduces overall security.

Free Microsoft Office alternative

Need a Lightweight, Compatible Office Suite for Your Team?

If complex Microsoft 365 licensing, syncing issues, and Conditional Access policies are complicating your workflow, consider WPS Office. It provides a familiar, fast, and highly compatible alternative for opening, creating, and editing documents locally without the heavy overhead.

1. Download the Installer: Visit the official WPS Office website and click on the 'Download' button for your respective operating system.
2. Install WPS Office: Run the downloaded installer file and follow the on-screen prompts to set up the software.
3. Open Your Documents: Launch WPS Office and instantly open your Word, Excel, or PowerPoint files without needing complex cloud sync configurations.

Highly compatible with Microsoft Office formats (.docx, .xlsx, .pptx)Lightweight and fast installation for both internal teams and external contractorsFamiliar user interface requiring zero learning curvePowerful PDF editing and conversion tools built directly into the suite

microsoft office alternative - wps office

Frequently Asked Questions

Why can't I exclude just OneDrive from the Office 365 apps Conditional Access policy?

Microsoft Entra groups OneDrive and SharePoint under the broader 'Office 365' application group. If the entire group is selected as the target in a Conditional Access policy, individual components like OneDrive cannot be separated or excluded using the exclusion tab. You must target individual apps instead.

Does B2B Sync support MFA for external users?

Historically, the OneDrive sync client has struggled with B2B Sync when MFA is strictly enforced on the resource tenant via Conditional Access. While Microsoft continually updates B2B direct connect and sync capabilities, policy conflicts often still require administrators to adjust MFA requirements specifically for SharePoint Online.

Will excluding SharePoint from the MFA policy affect Teams document syncing?

Yes. Microsoft Teams document libraries are backed by SharePoint Online. Applying Conditional Access changes to SharePoint will directly impact and resolve the ability to sync files from shared Microsoft Teams channels for your guest users.

Microsoft Office Security Issues