A client has your sharing invitation, but Microsoft 365 says they cannot open the file. Before changing permissions, compare the address you invited with the account their browser is actually using. A saved personal account, an old work account or a different guest identity can send them into the wrong sign-in session.
This guide covers files shared externally from business OneDrive or SharePoint. Start with one affected person and one file. Keep the document private while you work through the checks. If you are setting up the original share, follow our guide to sharing a file with a client.
This is a general diagnostic guide based on Microsoft documentation. The illustration and checklist are conceptual; they do not show Microsoft software or a tested customer case.
Confirm the invited address and the exact file
Ask the sender to confirm the full address they granted access to, then compare it with the recipient’s intended sign-in account. A familiar display name is not enough. A forwarded invitation does not automatically authorise the person who received the forward.
Check that both people mean the same file in the same OneDrive or SharePoint location. The sender should open the item from its library, confirm it still exists and identify the intended sharing link. An old email, a similarly named copy or a link to a different folder can send the recipient somewhere else.
Use the original invitation or the link confirmed by the sender. If the invitation went to an email alias, keep the original invitation email: Microsoft specifically documents an invitation-link requirement for guests using an alias. Avoid guessing a replacement sign-in URL.
Try the intended account in a separate session
On the Microsoft sign-in or account-selection screen, inspect the account being offered. If it is wrong, choose another account where that option is available. A work or school account and a personal Microsoft account can be separate identities even when their displayed email address looks the same.
Save open work before signing out. If your organisation permits it, reopen the verified invitation in a private browser window or another approved browser session and sign in with the intended identity. Microsoft recommends this comparison when a different active account causes an AADSTS50020 error. A private window cannot grant permissions or bypass device and access policies.
Follow the sign-in method offered for the invitation. Depending on the guest’s identity and the organisation’s configuration, that may be a work account, personal Microsoft account, another configured identity provider or an email passcode. Do not create a new account just to experiment. If you are unsure which identity previously accepted the invitation, ask the sender’s administrator.
Enter a verification code only in the legitimate sign-in flow you started. Never send the code or your password to the sender or support team. Close the test session afterwards. If the right account opens the file, record which account worked so the next visit starts correctly.
Have the sender check the actual permission grant
If sign-in succeeds but the file still will not open, the sender should select that exact item and inspect Manage access. Labels and layout vary, so check both the people who have access and the relevant sharing links. Confirm the intended recipient and the approved permission level.
A link copied with People with existing access does not grant new permission. An organisation-only link is also unsuitable for an external guest. The sender must establish that access was actually granted to the intended recipient, rather than relying on the fact that a URL was sent.
If access is missing, the authorised file owner can arrange the appropriate named-person share under the organisation’s rules. Keep the scope to the required item and permission. Do not change the link to Anyone, share a larger folder, remove document protection or turn off a security control to get past an error. Existing folder or site permissions may need an administrator to review them.
Check the October 2026 guest access transition
An older link that suddenly fails may need a different check. Microsoft’s current FAQ describes the retirement of legacy SharePoint Online one-time passcode authentication for commercial tenants, scheduled for October 2026. This rollout is separate from Microsoft Entra B2B email passcodes, which remain supported.
Once the change applies to a tenant, an external recipient needs a matching Microsoft Entra B2B guest account in that organisation’s directory to use previously shared Specific people links. Microsoft says recipients with a matching guest account retain access.
If the account is missing, an administrator can create it using the email address associated with the original share. Alternatively, a user with sharing permission can share or reshare at least one appropriate item with that recipient to create the guest account. Microsoft’s current FAQ says every old item does not need to be reshared individually.
Ask the administrator to confirm the tenant’s position and the existing permissions before making changes. There is no single date you can assume for every business, and an access-denied message alone does not prove this transition caused the problem.
Send useful evidence to the administrator
Stop repeating sign-in attempts if the account and file permissions appear correct. Through your approved support channel, provide:
- The invited address and the account type used, without passwords or verification codes.
- The exact file or approved sharing link, shared only with the authorised support team.
- The error text, time and time zone, plus a request or correlation ID if shown.
- Whether access worked before, who else is affected and what the separate-session check changed.
Crop screenshots to the relevant error and remove unrelated names, messages and document contents. The administrator can check the guest’s accepted identity, sign-in logs, sharing restrictions and cross-organisation access policies. MFA or device requirements should be investigated through the approved process.
Where the redeemed identity needs correction, Microsoft provides an administrator-only redemption-reset process that preserves the guest object ID, group memberships and app assignments. Deleting and recreating the guest should not be a casual troubleshooting step.
If you need help isolating the failure, Osmicro’s IT support team can investigate the account and access path. A useful resolution leaves the intended person able to open the intended file with the approved permissions still in place.
Microsoft references
- Microsoft Entra B2B invitation redemption
- Microsoft AADSTS50020 troubleshooting
- Microsoft OneDrive sharing and permissions
- Microsoft FAQ on the October 2026 external sharing transition
- Microsoft Entra email one time passcode authentication
- Microsoft reset guest redemption status
- Microsoft cross tenant access overview
- Microsoft authentication and Conditional Access for B2B users
References checked 13 November 2026. Settings and sign-in experiences depend on the organisation. This is general guidance; no customer incident or live tenant test is claimed.
Feature: original AI-created conceptual artwork prepared for this article. It is not a Microsoft interface capture.