Once external sharing has been enabled for a site collection and sharing permissions established, internal users can send invitations, create guest links (if anonymous sharing is enabled), revoke access, and so on.

The process of sharing a site or document with an external user is same as sharing with an internal user, but depends on settings controlled by the site collection admins. By default,

• Sites have two default user groups: members and visitors. Members are internal users with access to the entire site; they have edit privileges. Visitors are external users; they have view-only privileges.
• Members of a site can share sites and documents with internal and external users. The site owner’s approval is not required. These default settings can be changed (see Change Sharing Default Settings below).
• Visitors can share the site or documents with existing users (both Cornell users and any external user who has ever been invited to share any site or document in Cornell’s SharePoint Online tenant), but the sharing invitation will not be sent until the site owner has approved the request. Visitors cannot invite or share with new external users. These default settings cannot be changed.

Change Sharing Default Settings

A site’s owner or admin can modify the settings that control whether approvals are required.

1. Under the gear menu in the Office 365 toolbar, select Site settings, then click Site permissions.
2. In the Permissions ribbon, click Access Request Settings.
3. In the Access Requests Settings dialog box,

• If you want to completely disable sharing for this site (including document sharing), uncheck the first check box (“allow members to share the site…”).
• If you want to approve all requests to add members to the site, uncheck the second box. When checked, users can directly share the site, files, and folders with other users. When unchecked, user sharing invitations are first send to the email listed below for approval. If approved the invitations are then sent to the recipients.
• If you want visitors with no access rights who attempt to access your site to be able to submit a request for access, leave the third box checked. If unchecked, visitors without access rights will be simply denied access.

The following table describes the interactions between and among these controls in more detail.