Adding an external person to a team involves several independent controls. A failure
at any one of them looks the same to the user: the address is not found, and nothing
happens.
The layers
| Layer | Controls | Where |
|---|---|---|
| External collaboration settings | Who may invite, and which domains may be invited | Microsoft Entra ID |
| Teams guest access | Whether guests may be added to teams at all | Teams admin centre |
| Team settings | Whether the specific team's owners may add guests | The team |
| Sharing settings | Whether SharePoint permits external sharing for that site | SharePoint admin |
The domain allow list
The setting that produces the most confusing symptom is **collaboration
restrictions**:
- Allow invitations to any domain — the default.
- Deny invitations to specified domains — a block list.
- Allow invitations only to specified domains — an allow list.
Under an allow list, an invitation to any domain not on it is refused **before an
invitation object is created**. Directory search returns no matches and nothing is
sent. That is why one firm works and another appears to be a broken search box.
The tell: guests from other domains exist and were added successfully in the past.
Compare the failing domain against the allow list and the ticket is answered.
Confirm nothing was sent
Check the audit log for the invitation attempt. "Failure — domain not allowed" tells
you the block was at the tenant boundary, which distinguishes it from "the invitation
was sent and the guest has not redeemed it" — a completely different conversation.
The fix is not yours to make
An allow list exists because someone decided which organisations may be invited into
the tenant. Adding a domain widens that decision for every user, permanently.
Raise it as a change request to the identity or security team, with:
- the domain and the specific person,
- the business justification and who is sponsoring it,
- the expected duration, if it is project-bound.
Then tell the requester exactly that: what you raised, who decides, and when to
expect an answer. Not "it's with another team."
Do not route around the control. Sharing the documents via an anonymous SharePoint
link, or adding the guest to a different tenant-adjacent workspace, defeats the
allow list while looking helpful. If the domain is not approved, the content is not
approved to go there either.
Once the domain is approved
- Invite the guest; they receive an invitation to redeem.
- Guests do not consume a licence for collaboration.
- Guest access should be reviewed. Put an end date on it if the work has one.
Related
- Sharing and least privilege
- Verifying a caller's identity