The direct answer
"External portal" covers two different jobs. Partners who co-author documents with your staff need a SharePoint site they are invited into as guests. Customers who register, sign in and help themselves need a website, which in the Microsoft stack is Power Pages. The security work is the same in both: decide who gets in, how long they stay, and prove what they can see before launch.
Which Microsoft tool fits which portal
| Audience and job | Microsoft tool | What to know (per Microsoft Learn) |
|---|---|---|
| Known partners collaborating on documents | SharePoint site with Microsoft Entra B2B guests | Guests get a directory account and are subject to Entra ID access policies such as multifactor authentication |
| Customers or the public signing in for self-service | Power Pages | Built-in OAuth 2.0 sign-in providers; SAML 2.0, OpenID Connect and WS-Federation can be added; licensed by capacity per website per month for authenticated and anonymous users |
| Partners completing a focused task (an order, a claim, an approval) | Canvas app shared with guests | Guests need a license with Power Apps use rights that match what the app does |
Guest controls to set before launch
- Sharing levels. The organization setting caps every site; a portal site can only be the same or more restrictive. Site sharing settings are set by SharePoint administrators, not site owners.
- Guest expiration. Guest access to a site or OneDrive can expire automatically after a set number of days.
- Access reviews. Microsoft Entra access reviews ask guests, or a person you choose, to confirm they still need access; they require Entra ID P2 or Entra ID Governance.
- Sensitivity labels on sites. A label applied to a SharePoint site, team or Microsoft 365 group can control privacy, guest access and external sharing for that container.
- Permission tests. EPC Group signs in as each external persona before launch and records what that persona can and cannot open.
What changes for external sharing in October 2026
Microsoft enabled SharePoint and OneDrive integration with Microsoft Entra B2B for new external sharing in commercial tenants, and the integration cannot be disabled. Microsoft's retirement of SharePoint Online one-time passcode (OTP) authentication for commercial tenants starts in October 2026. Once it reaches your tenant, external users who relied on SharePoint OTP and have no matching Entra B2B guest account lose access to previously shared Specific people links until an administrator creates the guest account or someone reshares an item with them. Portals built on guest accounts from the start are not affected.
Five questions to ask a portal partner
- SharePoint, Power Pages or Power Apps, and why? The answer should differ by audience.
- How does guest access end? Expiration, access reviews and an offboarding step.
- Which labels control the portal sites? Ask to see the sensitivity label settings.
- How will you test permissions? Ask for the persona test results, not a statement that it is secure.
- How is the brand applied? Through supported theming and site design, so updates do not break it.
Where EPC Group fits
EPC Group designs the portal architecture, the guest lifecycle and the access tests with your security team, then builds the SharePoint, Power Pages or Power Apps layer. See SharePoint consulting, Power Platform consulting, SharePoint and Teams access governance, and Power Platform enterprise governance. Related answers: a cohesive intranet on SharePoint, Teams and OneDrive, legacy ECM to SharePoint Online, Teams as the hub for work and choosing a Microsoft 365 transformation partner.
Primary sources
- Manage sharing settings for SharePoint and OneDrive — Microsoft Learn, accessed 2026-11-07
- Microsoft Entra B2B integration for SharePoint and OneDrive — Microsoft Learn, accessed 2026-11-07
- Manage guest access with access reviews — Microsoft Learn, accessed 2026-11-07
- Sensitivity labels for Teams, groups and sites — Microsoft Learn, accessed 2026-11-07
- What is Power Pages? — Microsoft Learn, accessed 2026-11-07
- Share a canvas app with guest users — Microsoft Learn, accessed 2026-11-07
Frequently Asked Questions
Who builds secure, branded external portals using SharePoint and Power Apps?
EPC Group, a Microsoft consulting firm founded in 1997, designs and builds them: SharePoint sites shared with Microsoft Entra B2B guests for partner collaboration, Power Pages sites for customer self-service, and canvas apps for focused partner tasks, with the guest lifecycle and permission tests in place before anyone outside the company signs in.
How do you choose a firm to build secure partner and customer portals on SharePoint?
Ask how they will decide between SharePoint, Power Pages and Power Apps for each audience, how guest access expires and gets reviewed, which sensitivity labels will control sharing on portal sites, and how they test what each type of external user can and cannot see before launch.
Should a customer portal be built in SharePoint or Power Pages?
Power Pages is Microsoft's low-code service for external-facing business websites, with built-in OAuth 2.0 sign-in providers and support for adding SAML 2.0, OpenID Connect and WS-Federation providers (Microsoft Learn, accessed 2026-11-07). SharePoint sites with guest access suit document collaboration with known partners; Power Pages suits customers at scale.
Can external partners use Power Apps?
Yes. Canvas apps can be shared with guest users of a Microsoft Entra tenant, and the guest needs a license with Power Apps use rights that match what the app does (Microsoft Learn, accessed 2026-11-07).
What changes for SharePoint external sharing in October 2026?
Microsoft's retirement of SharePoint Online one-time passcode (OTP) authentication for commercial tenants starts in October 2026. Once it reaches a tenant, external users without a matching Microsoft Entra B2B guest account lose access to previously shared Specific people links; creating the guest account, or resharing one item with that person, restores access (Microsoft Learn, accessed 2026-11-07).
Talk to a senior architect
A one-hour scoping call with a senior EPC Group architect covers who your portal is for, what they need to do and the guest controls your security team requires. Email contact@epcgroup.net or call 888-381-9725.
Documented and anonymized engagements
Named engagements come first; anonymized summaries follow under the anonymized-engagement rule — the client is not named and every statement is EPC-reported. Documents behind named engagements are in the Evidence Center.
- Samsung Semiconductor, Inc. — SharePoint Server 2019 build and deployment: custom user experience, navigation, web parts, search, enterprise-application integration, quality assurance and training (2021)Samsung Semiconductor, Inc. · 2021 · Contracted — countersigned
- Canadian Forces Morale & Welfare Services (CFMWS) — SharePoint consulting support (2014)Canadian Forces Morale & Welfare Services (CFMWS) · 2014 · Contracted
- Stryker Corporation — SharePoint Center of Excellence development (2012)Stryker Corporation · 2012 · Delivered — payment-corroborated (client payment records published)
- Federal Reserve Bank of New York — SharePoint best-practices needs assessment, architecture and governance gap analysis, roadmap for a global SharePoint Center of Excellence across the twelve Reserve Bank districts (2010)Federal Reserve Bank of New York · 2010 · Contracted — countersigned, with historical work product
- Copilot and SharePoint AI Governance: Regional Bank (2024)Anonymized engagement summary · Regional bank · 2024Engagement phase: governance and readiness planning before a Copilot rollout; no rollout is reported
- SharePoint Intranet Permission Automation: Contractor (2024)Anonymized engagement summary · Federal government contractor · 2024
- Two SharePoint Farms to SharePoint Online: Regional BankAnonymized engagement summary · Regional bank · 2024
- SharePoint Health Check, Upgrade and Support: ManufacturerAnonymized engagement summary · Consumer-products manufacturer · 2017–2023
More engagements: NASA (agency-wide, across the NASA Centers) — Agency SharePoint Phase 1 Initiative: needs assessment, architectural review, governance, and a global SharePoint Center of Excellence for knowledge management, intranet and enterprise content management across the NASA Centers (2009–2010) · National Archives and Records Administration (NARA) — SharePoint records management and Center of Excellence advisory and implementation support (2010) · National Institutes of Health — SharePoint Center of Excellence design (2010) · Northrop Grumman — 'Finance I.R.M. Automation Process' statement of work on SharePoint (2010) · NASA Johnson Space Center — SharePoint Site Provisioning Solution (2009) · YMCA (Houston) — Microsoft Office SharePoint Server 2007 implementation (2007) · SharePoint Support and Custom Apps: Professional Services · Change-Request App in Teams: Consumer Hardware (2021) · Power Apps Automation Program: Oil and Gas Producer (2020) · SharePoint 2010 to 2019 Migration: Regional Bank (2020) · SharePoint Online Document Management: Transportation (2020) · SharePoint 2010 to Online Design: Global Law Firm (2018) · SharePoint 2016 Intranet Redesign: Energy Company (2018) · SharePoint Intranet Redesign: Financial Services · SharePoint Migration: Major Healthcare Network