You want clients, vendors or job applicants to drop files into a SharePoint library. You don't want them browsing the library, opening other people's files or joining your site. So can external users upload to SharePoint without seeing anything else? Yes, but only one built-in feature, Request files, lets external users upload files to SharePoint on those terms. It also depends on a setting many IT teams switch off.
Ways to allow external users to upload files to SharePoint
There are five routes. The table shows what each one asks of the outsider and of your admin, and each has its own section below.
| Option | Does the outsider need an account? | What they can see | What your admin must allow | Good for |
|---|---|---|---|---|
| Request files link | No. They type a name | Only the upload box | Anyone links, with upload permission for folders | One-off uploads when Anyone links are on |
| Shared folder with "Can edit" | A guest account in your directory (sign-in or emailed code) | Everything in that folder, plus other guests' names | External sharing for guests on the site | A few known partners who work in the folder with you |
| Microsoft Forms or library forms | Must be in your organization | The form | Nothing extra, but outsiders can't use it | Internal uploads only |
| Power Automate (email in) or Power Apps | Email: no. Power Apps: a guest account, and often a license | Email: nothing. Power Apps: the data the app uses | A flow or app someone builds and maintains | Teams that already run Power Platform |
| Upload page outside SharePoint (for example File Request Pro) | No | Only your upload page | Usually one approval of the app | Many outsiders, recurring requests, Anyone links off |
Option 1: Request files, if Anyone links are on
Request files is SharePoint's own upload-only link. You pick a folder, create the request and send the link. Microsoft says people who upload this way "can't view, edit, delete, or download files in the folder or see who else uploaded." They don't need a Microsoft account. If they aren't signed in, they enter a first and last name, which Microsoft says is not validated.
The catch is the requirements. Request files only works when:
- your admin has enabled Anyone links;
- Anyone links for folders are set to View, edit, and upload or View and upload;
- Allow only users in specific security groups to share externally isn't turned on;
- the Request files setting is on for the tenant and the site.
Microsoft's own note is blunt: "Disabling Anyone links also disables Request files on SharePoint and OneDrive." The link also works for whoever has it, so a forwarded link lets a stranger upload too.
If those settings are on in your tenant, this is the simplest answer. Our guide to SharePoint Request files has the setup steps, the admin settings and what to check when the button is missing.
Option 2: Share a folder with each person as a guest
When Anyone links are off, most people share a folder with the outsider and give them edit rights. It works, but it gives them more than an upload box.
How to set it up
- Create one folder per outsider, for example "Vendor - Acme Supplies". Never share one folder with several outside people.
- Select the folder and choose Share.
- Type the person's email address in the Name, group or email box.
- Use the pencil icon to set the permission to Can edit. "Can view" and "Can't download" don't let them upload.
- Add a short message and select Send.
If sharing outside your organization is blocked, ask your admin to check the site's sharing setting. It needs to allow at least "New and existing guests". A site can never be more open than the organization-level setting. Microsoft also notes that not every new site allows external sharing by default.
What "Can edit" gives them
Edit rights cover the whole folder. The guest can open, download, change and delete anything in it, including files your team adds later.
Guests in the same folder can also see each other. Microsoft says that when a folder is shared with several guests, "the guests can see each other's names in the Manage Access panel." That's why step 1 says one folder per outsider.
And each guest gets an account in your directory. Between May and July 2026, Microsoft switched SharePoint and OneDrive sharing to Microsoft Entra B2B for new external sharing in commercial tenants. The switch can't be turned off. Sharing a file or folder with someone outside now always creates a guest account. People without a work or Microsoft account can usually sign in with a one-time code that Entra emails them. That code is on by default, but an admin can turn it off.
That guest account is someone's job to remove later. Your admin can make guest access expire automatically after a set number of days, which helps if you collect from many people.
Why there's no "upload only" permission level
You might think a custom permission level could fix this: allow adding files, block viewing them. SharePoint doesn't allow that combination. In Microsoft's permission reference, Add Items depends on View Items, so selecting Add Items also selects View Items. Anyone who can add files to a library or folder can also see what's in it. Request files is the only built-in way around that rule.
If an outsider's old link stopped working
Microsoft is retiring SharePoint's own one-time passcode sign-in for commercial tenants. Its Message center post MC1243549 (updated October 1, 2026) has the retirement starting in mid-October 2026 and finishing by the end of November 2026. This hits people who signed in that way on older "Specific people" links. If they have no matching Entra guest account, they get access denied once the change reaches your tenant. To fix it, an admin can create a guest account for that email address. Or someone can share at least one file, folder or site with the person again. You don't have to reshare every item.
Our guide to the SharePoint one-time passcode retirement covers the timeline and what admins should check.
Option 3: Microsoft Forms and document library forms
Forms works well for file uploads inside your company, but not for outsiders. Microsoft says the file upload question "is only available when 'Only people in my organization can respond'" (or the specific-people-in-your-organization setting) is selected. So a form set to "Anyone can respond" can't have an upload question.
The newer forms you can create from a SharePoint document library have the same limit. Microsoft's announcement (MC1188226) says: "External or guest sharing of forms is not supported."
Our guides on the Microsoft Forms file upload question and on sharing Microsoft Forms with external users cover the limits and the workarounds.
Option 4: Power Automate and Power Apps
Email in, saved to SharePoint by a flow
Outsiders email their files to a shared mailbox, and a Power Automate flow saves the attachments to a library. The flow starts with the Outlook trigger "When a new email arrives in a shared mailbox (V2)". It then creates a file in SharePoint for each attachment.
Senders need no account and never see SharePoint. The downside is that people send whatever they like, and logos in email signatures get saved as files. Large attachments can bounce because email has size limits, and you have no record of who still owes you what.
It's a reasonable stopgap when clients already email you their documents anyway.
Power Apps and Power Pages
A canvas app or a customized library form can collect files into SharePoint. Outsiders still have to sign in as guests in your Microsoft Entra directory. Depending on the app, they may also need a Power Apps license. Microsoft's licensing table shows a guest with no license can't run a canvas app. And the app's data sources "must also be made accessible to the guest", so the guest still gets permission on the library behind it.
Power Pages is the Microsoft product built for anonymous visitors. It stores data in Dataverse, so expect a website project rather than a quick upload form.
Option 5: An upload page that needs no account
The last route keeps SharePoint out of the outsider's view entirely. You send a link to a web page. They upload there, and the files are saved into the SharePoint library and folder you chose. Nobody joins your directory, and your Anyone-link settings don't come into it.
Before you pick a tool, check four things:
- Where the files end up. Your own library and folder, ideally with subfolders per client or vendor.
- What IT has to approve. Which Microsoft permissions the app asks for, and who signs off.
- Where the files travel. Many tools store files for a while on the way to SharePoint. Ask how long.
- What happens after the upload. Reminders, a list of the documents you need from each person, due dates.
How File Request Pro does it
File Request Pro gives you an upload page for each request. Your clients or vendors open the link, answer any questions you add, and upload. They don't need an account or a login, and they never see the library or the site. You pick the destination with a folder chooser. Files are saved into that SharePoint folder, and can go into subfolders named from the uploader's answers.
- Plans: SharePoint is on the Pro plan and up. Google Drive, OneDrive and Dropbox are on every plan.
- Trial: the free trial (15 days or 25 files, no credit card) includes SharePoint, so you can test it against your own library.
- IT approval: the app asks for the Microsoft permissions Files.ReadWrite and Sites.ReadWrite.All. On Microsoft's default tenant settings, an admin approves it once.
- Storage on the way: files pass through File Request Pro's servers before they reach SharePoint. On Business and up, Pipeline mode removes our copies once the files are in your cloud.
It's built for receiving files. If clients also need to open and work on documents you share with them, look at building a client portal in SharePoint instead.
Before you send the first link
- Test it from outside. Open the link in a private browser window, where you're not signed in to your work account. If it asks you to sign in, use a personal email address.
- One folder per sender. Even with upload-only links, separate folders make it clear whose files are whose.
- Tell people what to send. Put the list of documents and the file types in the request message.
- Set an end date. Expire Request files links and guest access when the job is done.
Common questions
Can external users upload to SharePoint without a Microsoft account?
Yes. A Request files link needs no account at all, as long as Anyone links are on. A shared folder works too, because by default the person can sign in with an emailed one-time code. But they become a guest in your directory and can see everything in the folder.
Can I make a SharePoint folder upload-only for external users?
Only with Request files. SharePoint's permission levels can't grant adding files without viewing them, because Add Items depends on View Items.
How do I let vendors submit files without SharePoint access?
Use a Request files link if your tenant allows Anyone links. If it doesn't, use an email-to-library flow or an upload page outside SharePoint. Neither needs a guest account or any permission on your site.
Can I use OneDrive Request files instead?
Yes. OneDrive has the same feature and the same Anyone-link requirement. The files land in your OneDrive rather than the library. See our guide to OneDrive file requests.
