Can an external client approve a document for our 40-person law firm without a staff Microsoft 365 account?
Yes, but not anonymously. A client can respond to a Power Automate approval as a Microsoft Entra B2B guest without an employee account, provided they accept the invitation, hold a Power Automate license through your tenant or their own, and act from the Power Automate portal. Outlook approval buttons don't work for guests. For an occasional review, share only the needed SharePoint document and have a partner record the client's written instruction.
The common mistake at a 40-person firm is treating three separate things as one. Guest identity decides who the client is inside your tenant. Document access decides what the client can open. The approval experience decides where and how the client actually says yes. A client who can read a shared file is not automatically able to answer a Power Automate approval, and planning around that gap avoids a client-facing workflow that fails on its first real matter.
Guest approval or shared document: how to decide
- Entra B2B guest plus Power Automate approval fits when the client is recurring, will accept a B2B invitation, sign in and consent, has a Power Automate license assigned through your tenant or their home tenant, and can work in your tenant's Power Automate portal; avoid it when anyone expects anonymous approval or a one-click button inside the client's Outlook.
- Restricted SharePoint sharing plus a separately recorded client instruction fits when review is occasional and an accountable partner already runs a written authorization process the firm trusts; avoid it when you need a native, system-tracked approval step, because sharing grants document access and nothing more.
Microsoft's Power Automate guest documentation, showing the revision label 'Last updated on 04/30/2026', is explicit about the guest route. Guests must accept the B2B tenant invitation, and guests who haven't accepted are removed from the approval assignee list and can't take part. Guests need to go to the Power Automate portal to act on an approval. The same page states that actionable approval mails in Outlook aren't supported for guest users in a tenant. That date is a documentation revision, not a launch or effective date for guest approvals.
Our recommendation for a 40-person firm
Use the guest approval route for a small set of recurring clients who will complete the invitation and licensing steps once, and keep restricted document sharing with a partner-recorded instruction for everyone else. The one condition that changes the answer: a client who can't meet the guest identity, license or portal requirements belongs on the written-decision process, not on a native approval that will silently drop them from the assignee list.
Neither route, on its own, establishes that a click or a reply is a legally sufficient electronic signature. Whether an approval satisfies an engagement letter, court rule or signature requirement is a question for the firm's own counsel, and the workflow should be designed after that answer, not before.
Chrysis builds and tests these client-facing approval flows for professional-services firms, including the guest invitation, license check and fallback path, so the first client to use one isn't also the test case.
Engineering detail: identity, licensing and sharing
Licensing is the requirement most often missed. Microsoft's guest page says the guest must 'Have a Power Automate license assigned through either the tenant that hosts the flow, or the home tenant of the guest user.' A client with their own Microsoft 365 tenant may already be covered there, while a client on consumer email typically isn't, so confirm the license source per client before assigning them to an approval.
SharePoint sharing follows the most restrictive setting in play. Microsoft's external sharing overview, showing 'Last updated on 05/07/2026', states that when a site's external sharing option and the organization-level option don't match, the most restrictive value always applies. A matter site set more open than the tenant won't share more than the tenant allows. Resist loosening tenant-wide sharing to make one workflow run; share the specific document instead of the site or library.
A clean test plan checks each layer separately with a friendly test guest before any real client sees it:
- Prerequisite: confirm with counsel which client decisions the firm will accept through a native approval and which require its existing written authorization or signature process.
- Invite a test guest through Microsoft Entra B2B and confirm the invitation is accepted, the guest signs in and consent completes.
- Confirm a Power Automate license is assigned to that guest through your tenant or the guest's home tenant.
- Assign the test guest to a Power Automate approval and confirm they can find and respond to it in your tenant's Power Automate portal, not from Outlook.
- Share only the single review document with the test guest and confirm site-level and organization-level sharing settings permit it without widening tenant-wide sharing.
- Document the fallback: the responsible partner records the client's explicit instruction and the exact document and version in the matter record, and never clicks a native approval on the client's behalf.
The fallback step matters more than it looks. A partner recording 'client approved version 4 of the settlement draft by email on this date' in the matter record is honest and auditable. A staff member responding to a native approval as if they were the client is neither, and it undermines the reason for having an approval trail at all.
Frequently asked
Does a client need a staff account in our tenant to approve a Power Automate request?
No. A Microsoft Entra B2B guest identity is enough, as long as the client accepts the invitation and meets the license and portal requirements.
Can a guest approve straight from the email in Outlook?
No. Microsoft states actionable approval mails in Outlook aren't supported for guest users, so guests act on approvals in the Power Automate portal.
Who pays for the guest's Power Automate license?
The license can come from the tenant hosting the flow or from the guest's own home tenant, so check which applies for each client.
Does sharing a SharePoint document count as the client approving it?
No. Sharing gives the client access to the file; the decision itself needs a native approval or a separately recorded instruction.
Is a Power Automate approval a legally valid signature?
Not by default. Whether it satisfies a signature or authorization requirement is a question for your counsel before you rely on it.