SYSTEM 8Discuss a system ↗
DOCS / RUN-ID-001

RUN-ID-001 / SOURCE CONTROLLED

Teams and SharePoint guest-access diagnostic

Use when a guest can participate in Teams but cannot open the connected SharePoint site or Files tab.

● CONTROLLEDOWNER / SYSTEM 8REVIEW / MONTHLY
01

Capture the identity

  • Failing URL, time, resource tenant and visible signed-in account.
  • Guest object ID, UPN, issuer/redemption state and group membership.
  • Exact Team, standard/private/shared channel and connected site URL.
  • Whether the same email address maps to personal and organisational identities.
02

Boundary sequence

  1. Tenant external-collaboration restrictions.
  2. Cross-tenant inbound access and trust.
  3. SharePoint tenant sharing capability.
  4. Site sharing capability.
  5. Team/site/channel group membership.
  6. Browser tenant and account session.
03

Minimum repair

Repair the smallest failed boundary. Correct stale redemption only after preserving memberships. Scope partner cross-tenant policy to the required organisation. Apply a site-scoped sharing change when the collaboration is site-specific. Leave the tenant default unchanged. Prefer role groups over direct permissions.

04

Journey test

  • Invitation and tenant switch.
  • Teams chat and Files tab.
  • Direct SharePoint navigation.
  • Upload/edit/download as allowed.
  • Negative access to unrelated sites and channels.
  • Repeat after sign-out using the documented joining guide.
05

Control record

Store object ID, sponsor, approved resources, groups, review and expiry. Do not publish guest email addresses in general documentation. Review duplicates and unredeemed invitations.