Problem: Using O365 as an Extranet. A basic analysis before starting is a minimal requirement. The existing Extranet will make a lot of the questions fairly easy to clarify. You can cover this in tremendous detail but to avoid information paralysis, I recommend a decision maker, and preferably someone that already works on Extranet. A committee is cool if you have the cash but it's so hard to guess at the future, my preference is to get the broad strokes right and amended once we are in the weeds. These four points can be answered with the right people in a meeting or may take months for complex organisations especially if there is no clear leader to make decisions.
Consideration Point:
1. Who is using the Extranet? Clients, partners, vendors, ..., or Client Users
2. How will Client and Company users authenticate? O365 options including ADFS, another federation service e.g. Ping, Passport/Live, Google, Facebook,...
3. Self-registration or known approved Client Users? Try to figure out what the process for on-boarding your Client User will be.
4. Client User Profile Usage? Will the client users amend content, have the ability to share permissions or old school, they will read web published pages (read-only). Will client users have OneDrive, use teams, only SharePoint or other O365 applications.
2.> O365 authentication
The most basic option is to allow O365 to have client users (guests), as long as a user has an O365 account they can be a Client User. You can also use any Microsoft account for a client user.
Azure has a service that allows for you to connect users as guests, the user shall use their own AAD or ADFS or any federation service including Google and Facebook to authenticate. Microsoft allows 5 guest accounts on AAD for every 1 member (licence user).
4.> Client Usage Profiles
O365 can share a document anonymously in a link within an email. Obviously, this means anyone can potentially access the file. However, to replace attachment in an email and wide distribution this is a great step forward, as you can control versions and retract the access at any point. Additionally, the link settings can be customised to control who can use the link. For example, you can set the specific people who get the link or you could specify only internal people get the link. Once it is set to "Anyone" the email or link can be forwarded and literally anyone can get access.
Governance: Manage O365 to apply the businesses rules so users comply with governance. O365 has an easy straight forward configuration to make this happen. When configuring sharing governance you need to ensure it is done at the O365, SharePoint Admin and Site Admin levels. If 1 of these says no external sharing you can't share so it is a fairly granular approach. This allows Extranet and Intranet to live on the same O365 tenant.
Licensing: As a general rule, there tends to be no cost for External users, as 5 client Users for every internal O365 user is allowed for the O365 extranet scenario. Check with Microsoft as business scenarios play out differently.
Thoughts:
Consideration Point:
1. Who is using the Extranet? Clients, partners, vendors, ..., or Client Users
2. How will Client and Company users authenticate? O365 options including ADFS, another federation service e.g. Ping, Passport/Live, Google, Facebook,...
3. Self-registration or known approved Client Users? Try to figure out what the process for on-boarding your Client User will be.
4. Client User Profile Usage? Will the client users amend content, have the ability to share permissions or old school, they will read web published pages (read-only). Will client users have OneDrive, use teams, only SharePoint or other O365 applications.
2.> O365 authentication
The most basic option is to allow O365 to have client users (guests), as long as a user has an O365 account they can be a Client User. You can also use any Microsoft account for a client user.
Azure has a service that allows for you to connect users as guests, the user shall use their own AAD or ADFS or any federation service including Google and Facebook to authenticate. Microsoft allows 5 guest accounts on AAD for every 1 member (licence user).
4.> Client Usage Profiles
O365 can share a document anonymously in a link within an email. Obviously, this means anyone can potentially access the file. However, to replace attachment in an email and wide distribution this is a great step forward, as you can control versions and retract the access at any point. Additionally, the link settings can be customised to control who can use the link. For example, you can set the specific people who get the link or you could specify only internal people get the link. Once it is set to "Anyone" the email or link can be forwarded and literally anyone can get access.
Governance: Manage O365 to apply the businesses rules so users comply with governance. O365 has an easy straight forward configuration to make this happen. When configuring sharing governance you need to ensure it is done at the O365, SharePoint Admin and Site Admin levels. If 1 of these says no external sharing you can't share so it is a fairly granular approach. This allows Extranet and Intranet to live on the same O365 tenant.
Licensing: As a general rule, there tends to be no cost for External users, as 5 client Users for every internal O365 user is allowed for the O365 extranet scenario. Check with Microsoft as business scenarios play out differently.
Thoughts:
- O365 uses Azure Active Directory (B2C), there is a 1-to-1 relationship between your tenant AAD and you O365 instance.
- External accounts can be connect as guests e.g. Another AAD tenant, Micsrosoft accounts (passport), ADFS or any auth provider (SAML), Facebook, Google+, AAD B2C (separate service from AAD). There is also a One Time Passcode option.
