SharePoint AADSTS90072 Error: Step-by-Step Guest Access Fixes

Resolve SharePoint guest creation failures and AADSTS90072 errors by properly configuring Microsoft Entra B2B integration, tenant policies, and sharing settings.

Dealing with external sharing issues can be incredibly frustrating, especially when collaboration with clients or partners halts due to confusing authentication codes. If you are struggling to get guests into your portal, we are here to help you get things back on track.

Problem Description: External Sharing Failures

When attempting to share SharePoint files, folders, or entire sites with external users, the invitation process fails or the external user receives an AADSTS90072 error upon logging in. This symptom usually indicates a breakdown in the handshake between SharePoint Online and your organization's directory services, meaning the guest account cannot be properly provisioned, authenticated, or permitted to access the requested resources.

Quick Answer for Azure AD Guest Errors

To quickly fix this, ensure that Azure AD B2B integration is enabled in your tenant via PowerShell. Next, check both the Microsoft Entra Admin Center and the SharePoint Admin Center to confirm that external guest invitations are permitted and the guest's specific domain is not actively blocked by your cross-tenant policies.

Likely Causes Behind AADSTS90072 and Authentication Issues

• Disabled B2B Integration: SharePoint is not configured to use Microsoft Entra (Azure AD) B2B functionality for guest handling.
• Restricted Entra ID Permissions: Guest invitation settings in Microsoft Entra prevent standard users or admins from inviting new external accounts.
• Domain Restrictions: The domain of the external user is explicitly blocked in your External Collaboration settings.
• Cross-Tenant Access Policies: Strict inbound or outbound policies in Entra ID are blocking the synchronization of external user identities.
• SharePoint Site-Level Blocks: Even if the organization allows external sharing, the specific SharePoint site collection might be restricted to "Existing guests only" or "Only people in your organization."

Recommended Solution: Enabling External Collaboration

1. Verify B2B Integration via PowerShell: Open the SharePoint Online Management Shell as an administrator. Run the command Get-SPOTenant | Select EnableAzureADB2BIntegration. If this returns "False", enable it by running Set-SPOTenant -EnableAzureADB2BIntegration $true.
2. Check Microsoft Entra External Identities: Log into the Microsoft Entra admin center. Navigate to External Identities > External collaboration settings. Ensure that guest invitation settings allow admins and users in the guest inviter role to invite guests.
3. Review Blocked Domains: While still in the External collaboration settings, scroll down to the collaboration restrictions and verify that the guest's domain is not listed under blocked domains.
4. Inspect Cross-Tenant Access: In the Entra admin center, check your Cross-tenant access policies to ensure there are no strict rules actively preventing inbound collaboration from the guest's tenant.
5. Update SharePoint Admin Center Sharing Limits: Go to the SharePoint admin center. Under Policies > Sharing, ensure the organization-level sharing is set to at least "New and existing guests." Then, check the Active sites list, select your specific site, and ensure its individual sharing setting also allows "New and existing guests."
6. Pre-Invite the Guest: If sharing directly from SharePoint still fails, manually invite the user as a guest directly inside Microsoft Entra ID. Once they accept the directory invitation, return to SharePoint and share the resource using a new link.

Alternative Solutions for Persistent Sharing Blocks

1. Generate a Brand New Sharing Link: If previous links are broken or tied to failed authentication attempts, delete the old sharing links in the SharePoint document's "Manage Access" panel and generate a fresh link.
2. Clear Guest Browser Cache: Ask the external user to clear their browser cache, or open the invitation link in a Private/Incognito window to prevent conflicting account credentials from causing the AADSTS90072 loop.
3. Audit Conditional Access Policies: Check if your organization has Conditional Access policies (like requiring MFA or blocking certain IP ranges) that the external guest is failing to meet.

Working with WPS Office: A Seamless Local Alternative

Because the AADSTS90072 error stems from Microsoft Entra ID and SharePoint cloud administration configurations, WPS Office cannot be used to bypass or fix tenant-level server issues. However, if your external collaborators are entirely locked out of Microsoft 365 cloud editors and need immediate access to work on files, WPS Office is an exceptional, free alternative for local document workflows. You can download the blocked files locally, share them via email or alternate secure transfers, and your external partners can use WPS Office to flawlessly open, edit, and save Word, Excel, and PowerPoint files without requiring complex cloud authentication.

Prevention Tips for Future Guest Invite Issues

• Pre-provision external guests in Microsoft Entra ID before sharing highly sensitive or complex SharePoint site links.
• Regularly audit your organization's External Collaboration settings and keep an updated whitelist of trusted partner domains.
• Standardize external sharing protocols by documenting which site collections are meant for external use and which are strictly internal.

FAQs About Microsoft Entra B2B and SharePoint

What exactly does the AADSTS90072 error mean?

This specific error code generally means that the user account from the external identity provider (the guest's home tenant) cannot be successfully authenticated or created in your resource tenant. It usually points to cross-tenant access restrictions or disabled Azure AD B2B integration.

Can I enable external sharing for just a single SharePoint site instead of the whole organization?

The organization-level settings act as a ceiling. If your organization-level setting is set to allow "New and existing guests," you can restrict individual sites to "Internal only," but you cannot make a single site "New guests" if the organizational level is restricted to internal users only. Organization policies must permit it first.