SharePoint External Sharing Broken After Enabling Conditional Access? Check Your Cross-Tenant Trust Settings
External sharing in Microsoft 365 is usually straightforward: invite a guest, they accept the invitation, and they gain access to the shared SharePoint site. But what happens when every invitation appears to work correctly, yet every external user receives a vague sign-in error?
Recently, we ran into exactly that scenario for one of our clients. The root cause turned out to be a subtle interaction between Conditional Access policies and Microsoft Entra cross-tenant trust settings.
The Problem
A client had created a SharePoint site specifically for sharing documents with external organizations.
Everything looked correct:
External sharing was enabled.
Guest invitations were sent successfully.
Guest users appeared correctly in Microsoft Entra ID.
SharePoint permissions showed the users had access.
Sign-in logs showed successful authentication events.
However, when any external user attempted to access the SharePoint site, they encountered an error after authenticating with their Microsoft 365 account:
The error occurred consistently regardless of which external organization the user belonged to.
Internally, users could access the site without issue. The problem affected only external guests.
Initial Troubleshooting
As with most SharePoint external access issues, we worked through the usual checklist:
Verified external sharing settings.
Confirmed guest invitation acceptance.
Reviewed SharePoint permissions.
Checked Microsoft Entra sign-in logs.
Tested direct document library URLs.
Removed and re-added guest accounts.
Validated that other SharePoint sites in the tenant allowed external access successfully.
Nothing stood out.
The authentication logs showed successful sign-ins, yet users were still blocked from accessing the site.
The Breakthrough
The turning point came when we tested with a completely different external account that did not already have MFA configured.
This time the sign-in process behaved differently:
The user accepted the SharePoint invitation.
Microsoft prompted the user to enroll in MFA.
MFA enrollment completed successfully.
The same SharePoint access error appeared immediately afterward.
That told us a Conditional Access policy was definitely involved.
The authentication flow was succeeding, but the trust relationship between the two tenants was not.
The Root Cause
The key clue came from reviewing recent security changes.
Shortly before the issue began, the client upgraded users to Microsoft 365 Business Premium licensing and implemented Conditional Access policies requiring multi-factor authentication (MFA) for all users.
The timing aligned perfectly with the start of the problem.
At first glance, however, this didn't seem to explain the situation because all of our test accounts already had MFA configured and were successfully completing MFA challenges.
However, the Microsoft Entra tenant hosting the SharePoint site was configured not to trust MFA claims from external Microsoft Entra tenants.
Under:
Microsoft Entra Admin Center → External Identities → Cross-Tenant Access Settings → Default Settings → Inbound Access → Trust Settings
this option was disabled:
Trust multifactor authentication from Microsoft Entra tenants
Microsoft's cross-tenant access settings control whether your tenant trusts MFA and device claims from external Entra organizations. Microsoft specifically documents that inbound trust settings determine whether MFA and device claims from another organization are accepted when Conditional Access policies are evaluated.
Because MFA was required by Conditional Access, but the tenant didn't trust the MFA completed in the user's home tenant, the authentication flow ultimately failed even though the user had successfully authenticated. Microsoft notes that cross-tenant access settings and Conditional Access are evaluated together for external users accessing resources in another tenant.
The Solution
We enabled:
✅ Trust multifactor authentication from Microsoft Entra tenants
under the default inbound cross-tenant access settings.
Once enabled:
Existing guest users could access the SharePoint site.
New guest invitations worked immediately.
MFA requirements remained enforced.
External users no longer received the sign-in error.
Why This Happens
This issue often appears after organizations improve their security posture.
The sequence usually looks like this:
External sharing is working normally.
Business Premium (or another license supporting Conditional Access) is introduced.
MFA-based Conditional Access policies are deployed.
Cross-tenant trust settings remain at their default state.
External guest access begins failing.
Because authentication succeeds and the error message is generic, administrators often focus on SharePoint permissions rather than Microsoft Entra trust relationships. Which is exactly what we did in this situation.
A Few Additional Considerations
MFA trust isn't the only setting available.
Depending on your Conditional Access and Zero Trust requirements, you may also need to trust:
Compliant devices
Microsoft Entra hybrid joined devices
Microsoft includes these trust options alongside MFA trust within cross-tenant access settings.
For example, if your Conditional Access policies require a compliant device, external users may encounter similar access issues unless device compliance claims are trusted from their home tenant.
Default Settings vs. Partner-Specific Settings
Many organizations immediately change the Default Settings because it's the fastest way to resolve the issue.
However, Microsoft also allows you to configure trust on a per-organization basis rather than applying the settings globally. Cross-tenant access settings support organization-specific inbound and outbound trust configurations in addition to tenant-wide defaults.
This can be useful when:
You only collaborate with a handful of trusted partners.
You want tighter control over external access.
Different partner organizations require different trust levels.
Quick Fix Summary
Symptom: External users can't access a SharePoint site and receive generic sign-in errors.
Recent Change: MFA-enforcing Conditional Access policies enabled.
Root Cause: Tenant does not trust MFA claims from external Microsoft Entra tenants.
Fix: Enable:
Microsoft Entra Admin Center → External Identities → Cross-Tenant Access Settings → Default Settings → Inbound Access → Trust multifactor authentication from Microsoft Entra tenants
Result: External users can successfully access the SharePoint site while MFA requirements remain enforced.
Comments