OneDrive vs SharePoint for client sharing: keep guest access in the right place

OneDrive can handle a few selected client files when the employee’s sharing settings permit it. A dedicated SharePoint site is a better fit for a continuing project that needs its own workspace and sharing policy. Both remain within the organization’s restrictions. Give each guest the file, folder or site access their work actually requires.

Suppose an agency’s client, Dana, needs to read Campaign-proof.pdf and later help edit Campaign-copy.docx. Freelancer Jules needs artwork only. Negotiation-notes.xlsx must stay internal. These are hypothetical project and policy examples; no Microsoft 365 tenant or guest account was tested.

The first proof could be a narrowly shared OneDrive file. For ongoing work, the agency can use a client SharePoint site and keep its negotiation material in a separate site with external sharing off.

Share the proof without inviting the client into everything

In OneDrive on the web, open Share and the link settings, then select Specific people and the intended recipients. Microsoft says that choice grants access to the specified identities, although other permissions may already exist. A forwarded invitation only works for people who already have access. People with existing access grants no new permission. Microsoft’s OneDrive sharing guide

For Dana’s first proof, choose a viewing permission and the correct invited address. Sending one selected file does not give Dana access to every file in the employee’s OneDrive.

When the assignment moves into a client site, keep the access scope deliberate. Membership in a Microsoft 365 group connected to that site makes the guest a site member. Site-member permissions can include editing and deleting files and list items, which reaches beyond reading one proof. Microsoft’s external sharing overview

If Dana cannot open the first link, investigate the link and its restrictions before expanding the grant. Group membership is appropriate when the client needs that broader collaboration role, not merely as a repair for a single failed link.

Jules needs a different audience. Sharing the same folder with both guests can expose their names to each other in Manage Access. Use separate folder audiences when that disclosure is unwanted. Folder editing also lets a recipient act on the folder’s contents, including moving, renaming, sharing and deleting items. Microsoft’s external sharing overview, Microsoft’s OneDrive sharing guide

Find the most restrictive sharing setting

SharePoint’s organization setting sets the maximum permitted external-sharing level. A site can restrict it further. OneDrive’s organization setting can match SharePoint’s or be more restrictive, and an individual employee’s OneDrive can have an additional restriction. Microsoft’s sharing settings guide, Microsoft’s individual OneDrive guide

The levels run from Only people in your organization, through Existing guests and New and existing guests, to Anyone. The following paper examples apply the most restrictive boundary. They do not establish a real guest’s file permissions.

Example	Settings being compared	Result of the boundary comparison
A: client site	Organization allows new and existing guests; site says Anyone	New and existing guests; no anonymous link
B: internal site	Organization allows new and existing guests; site is internal only	Internal only
C: requested OneDrive change	SharePoint allows Anyone; OneDrive organization allows existing guests; employee requests new and existing guests	Existing guests
D: restricted employee	SharePoint allows Anyone; OneDrive organization allows new and existing guests; user setting is internal only	Internal only

In example A, Dana could be an eligible new authenticated guest, but the invitation, file grant and other policies still need to permit her access. In example B, moving the proof into another folder on the same site does not raise the site’s external-sharing level.

Example C explains why a requested increase cannot invite a first-time client: the OneDrive organization allows existing guests only. It does not assume the administration screen will accept a setting above that limit. Example D explains why a particular employee can be blocked even though colleagues elsewhere are allowed to share.

The populated policy examples CSV includes all four cases and what remains unproven. Use it to record the boundary relevant to the failed invitation, then inspect the actual item permission. A policy comparison alone cannot prove that Dana can open the file.

New sites can also have different default sharing settings. Read the current site’s configuration instead of copying the result from a different client workspace. Microsoft’s external sharing overview

An external-sharing level and a link audience are different

Anyone permits unauthenticated file and folder links; site access still uses authentication. Allowing Anyone does not force every link to be anonymous. An organization can permit outside sharing while a particular link is restricted to People in your organization. Microsoft’s sharing settings guide

That is a common explanation for Dana’s failed proof link. An employee can open it and assume it works, while its audience excludes the client. Recreate the intended narrow invitation with the authorized external identity and check it using that identity.

For Specific people sharing, a recipient without a Microsoft account may be asked to verify their email with a one-time code. The precise experience depends on the account and configured sharing model; do not require Dana to create an account based on an assumed sign-in path. Microsoft’s guest-sharing guide

Microsoft Entra B2B integration is another administrative consideration. When enabled for file and folder sharing, it creates guest accounts and applies Entra’s external-collaboration settings. Site sharing always uses B2B. Ask the administrator which model is active when troubleshooting an invitation or domain restriction. Microsoft’s external sharing overview

Inspect the right administrative location

For organization settings, the administrator starts in SharePoint admin center > Policies > Sharing. Then inspect the client site’s individual sharing setting. For the employee OneDrive option, check Microsoft 365 admin center > Users > Active users > the employee > OneDrive > Sharing > Manage external sharing. Microsoft’s sharing settings guide, Microsoft’s individual OneDrive guide

The agency can write a useful support request:

Dana needs viewing access to Campaign-proof.pdf through a named external invitation. Please check the link audience, effective organization and location limits, and whether our configuration permits this new guest. The negotiation site must remain internal.

This gives support the intended identity, item and permission without asking for a blanket increase in sharing.

If Dana needs to edit Campaign-copy.docx later, review that file’s permission separately. A viewing proof and a jointly edited document do not require identical grants. Similarly, Jules’s artwork access does not require membership in the full client workspace.

Check the boundary from the guest’s account

Ask Dana to open the intended file with the invited email identity. Confirm the required viewing or editing task, then check whether unrelated client content is available. Separately confirm that the confidential negotiation site remains inaccessible. Microsoft’s recommended arrangement is to keep confidential information in a site with external sharing turned off. Microsoft’s external sharing overview

Use actual observations in the project record: invited address, item location, permission given, successful task and any unexpected access. An owner’s account has different permissions and cannot substitute for the guest’s check.

At project closure, review all applicable access routes. Dana might have a direct permission, a sharing link or group membership. Removing one link does not answer whether another grant still works. Details > Manage access is the documented file-level route for reviewing or stopping sharing; inspect relevant site and group membership too. Microsoft’s guest-sharing guide

Avoid temporarily turning off organization-wide sharing to close one project. Turning it back on can restore old guest access where individual sites were not disabled. Microsoft says new restrictions typically take effect within an hour, so confirm the resulting access separately from saving the setting. A server-side permission change also cannot recall a copy already saved on a guest’s computer. Microsoft’s sharing settings guide

For this agency, the closing record should identify Dana’s remaining project grants, Jules’s artwork grants and the still-internal negotiation site. Leave an unresolved access issue assigned to a named owner until the intended guest has been checked again.