Your External Partners Are Losing Access Right Now, and Nobody Is Telling You

This is happening during the window you are reading this in

SharePoint One-Time Passcode authentication is being retired. Message center item MC1243549. The timeline:

• May 2026 — new external sharing invitations began using Microsoft Entra B2B instead of OTP
• Mid-October 2026 — Phase 2 begins: the OTP flow is retired
• End of November 2026 — expected completion for production environments

During that window, external recipients who authenticated by passcode and never received a guest account lose access to links you shared with them in the past.

---

The detail that makes this different from an ordinary deprecation

Most retirements announce themselves. A service degrades, errors appear in a log, a dashboard turns amber, someone files a ticket.

This one is silent on both ends.

• The external user gets a generic access denied screen. No explanation that an authentication method was retired. No instruction for what to do next.
• You get nothing. No alert, no report, no list of who just lost access.

Now think about what that looks like from the outside.

A partner, client, auditor or contractor opens a link they have used for two years. It fails. They are not told why. The most natural interpretation available to them is: this company revoked my access on purpose.

People who believe access was deliberately revoked do not file support tickets. They assume a decision was made, and they work around it or wait to be told. Which means the population most affected is also the population least likely to report it.

That makes this a relationship and revenue problem wearing a technical costume. The failure is not that a service broke. The failure is that it broke in a way that is invisible to the only party who could fix it.

---

Who is actually affected

Narrower than the panic suggests. You are exposed only where all of these are true:

• Content was shared via a "specific people" link
• The recipient authenticated using a one-time passcode
• No Entra B2B guest account was ever created for them

Anyone who already holds a guest account in your directory is unaffected. Anonymous "anyone with the link" sharing is a different mechanism. This hits the passcode-only middle.

That middle is usually bigger than people expect, because passcode sharing was the path of least resistance for years — it required no directory change, no admin involvement, and no conversation with IT. It is exactly the sharing that happened *because* nobody had to approve it, which is also why nobody has a list of it.

---

Recovery: the one-step route most coverage skips

Two ways to restore someone:

1. Create an Entra B2B guest account for them. Clean, deliberate, correct for a large population.

2. Have an allowed user share or re-share at least one file, folder or site with them. This triggers the B2B invitation flow and provisions the guest account as a side effect.

Route 2 is underreported and operationally valuable. It means the business owner of the relationship can fix it themselves — the account manager, the project lead, the person who actually talks to the partner — without a directory change or a ticket queue.

For an urgent single case ("our auditor cannot open the evidence folder and the fieldwork window closes Friday"), route 2 resolves it in minutes. For a known population of eighty partners, route 1 is the right instrument.

Knowing both, and knowing which to reach for, is most of the operational value here.

---

Finding your exposure before your partners do

The whole game is converting a silent failure into a list you can work.

Step 1 — Inventory the external sharing surface. Every site and library with external sharing enabled, and the external identities associated with them.

Step 2 — Split the population. Separate externals who already hold Entra B2B guest accounts from those authenticating by passcode only. The second group is your exposure list. This split is the entire exercise.

Step 3 — Rank by relationship value, not by volume. This is where most remediation plans go wrong. A site with twenty dormant external viewers matters far less than the single shared folder your largest client's project manager opens every Monday, or the evidence folder one auditor needs during fieldwork. Sort by *who*, not by *how many*.

Step 4 — Provision or re-share ahead of their next access attempt. Pre-empting is cheap. Being told by a client that your systems locked them out is not.

Step 5 — Tell people. A short note to affected external contacts — "Microsoft is changing how external access authenticates; if you see an access denied message, reply and we will fix it immediately" — converts a silent failure into an inbound message. That single communication is worth more than any technical step on this list, because it repairs the broken feedback loop.

---

The emergency version

If you are reading this because someone already cannot get in:

• Confirm the pattern. External user, specific-people link, worked before, access denied now, no guest account in your directory. That combination is this issue.
• Re-share one item with them from an allowed user. Fastest path back.
• Confirm with the user directly — do not assume provisioning equals access restored. Have them open the link and tell you.
• Then go find the rest, because if one person surfaced, others are silently affected and have not said anything.

Point 4 is the one that matters. A single reported lockout during this window is not an isolated incident — it is a sample from a population you have not enumerated.

---

Why this is still the right change

It is worth saying plainly: Entra B2B is a materially better end state.

Passcode-based external access created a population of external users who were effectively invisible to identity governance. No directory object, no conditional access, no access reviews, no lifecycle, no clean answer to "who outside our organization can read this?"

B2B guest accounts are real directory objects. They can be governed, reviewed, conditionally restricted and offboarded. For anyone in a regulated industry who has ever been asked to produce an external access list during an audit, that difference is substantial.

The destination is right. The transition is just unusually unkind, because it fails silently in both directions.

---

Locked out partners, or need the exposure list built before they notice? Our emergency intake is open 24/7/365 — see Emergency Support or contact us. For the broader configuration work, see SharePoint Consulting.

Sources

• MC1243549 — Retirement of SharePoint One-Time Passcode and transition to Microsoft Entra B2B
• FAQ: Improvements to external sharing in OneDrive and SharePoint — Microsoft Learn
• SharePoint OTP Retirement Explained: Impact, Timeline, and Next Steps — Syskit