Body
When you share a OneDrive or SharePoint folder or file with someone outside St. John Fisher University, Microsoft may use one of two methods to verify the recipient's identity before granting access.
Both methods are secure and are designed to ensure that only the intended recipient can access the shared content.
Method 1: Email Verification Code (One-Time Passcode)
What the External Recipient Sees
When the recipient opens the shared link, Microsoft may display a message similar to:
"We've sent a verification code to your email."
The recipient then:
- Checks their email.
- Retrieves the one-time verification code.
- Enters the code into Microsoft.
- Gains access to the shared file.
When This Typically Happens
This method is commonly used when:
- The recipient does not have a Microsoft account.
- The recipient is not already known to Microsoft's identity systems.
- The recipient has not previously accepted a guest invitation from the organization.
Security Benefits
This method verifies that the recipient:
- Owns the email address used for sharing.
- Has access to the email account.
No permanent account is created in St. John Fisher University's tenant during this process.
Method 2: Microsoft Entra B2B (Business to Business) Guest Authentication
What the External Recipient Sees
Instead of receiving a verification code, the recipient may see an SJF branded sign-in page asking them to authenticate with a Microsoft account or organizational account.
They may also see a consent screen :
This is normal and expected behavior.
When This Typically Happens
This method is often used when the recipient already has:
- A Microsoft personal account (Outlook.com, Hotmail.com, Live.com, etc.)
- A Microsoft 365 work account
- A Microsoft 365 school account
- An existing Guest account associated with St. John Fisher University
Microsoft can recognize these accounts and verify the user directly instead of sending an emailed verification code.
Important Security Question
Is the external user giving St. John Fisher University their password?
No.
This is a very common concern.
When a guest signs in:
- Their username and password are validated by their own account provider.
- St. John Fisher University never sees their password.
- St. John Fisher University cannot access, recover, or view the credentials they enter.
For example:
If the recipient uses:
someone@hotmail.com
they authenticate directly with Microsoft's personal account service.
If the recipient uses:
someone@anothercollege.edu
They authenticate through that institution's Microsoft 365 tenant.
If the recipient uses:
someone@business.com
They authenticate using their organization's identity system.
The St. John Fisher University tenant only receives confirmation that:
"This person successfully authenticated."
The actual password remains private to the recipient and their own identity provider.
Frequently Asked Questions
Why did I not receive a verification code?
Microsoft may have recognized your existing Microsoft account and chosen to verify your identity through sign-in instead.
Can St. John Fisher University see my password?
No.
SJF never receives, views, or stores passwords entered on behalf of another organization or Microsoft account.
Do I need to create an SJF account?
Usually no.
Most external recipients can use their existing Microsoft account or organizational account.
Why am I being asked to accept permissions?
This is Microsoft confirming that you agree to establish a secure guest relationship with St. John Fisher University for accessing shared resources.
Is one method more secure than the other?
Both methods are Microsoft-supported authentication methods. In many cases, signing in with an existing account provides stronger identity assurance because the user can be protected by their normal password policies and multifactor authentication.