I'm in the process of setting up accounts for volunteers, contractors, and interns, and I need to clarify that these users aren't considered employees. I'm weighing two options: creating a completely separate domain, like external.%company%.com, or using a subdomain, like external.%company%.com. These users will need to go through HR and sign our acceptable use policy, and for now, M365 functions will be kept to a minimum without external emailing or collaboration. Have any of you set up something similar in your organization? What pros and cons should I be mindful of?
5 Answers
Consider a method like what Microsoft uses with a unique identifier in the email address, like '[email protected]' for third-party users. This helps indicate their relationship without having to go through the hassle of a new domain, which could dilute your brand and lead to potential deliverability issues when communicating externally.
Honestly, you should treat these users like employees in terms of trust. I suggest using the same domain but creating separate Organizational Units (OUs) to manage permissions. You can still show their status in their display names, like 'Jane Doe (Intern),' which can help with identification without complicating your domain structure too much. Just ensure you use role-based access control (RBAC) to manage their permissions effectively.
Seems like a sensible approach. Trusting them as much as employees is key, especially if they're having the same level of access. I've seen RBAC work great in similar scenarios.
Using a different UPN format with the same domain, like @external.company.com, can still meet your needs for distinction while keeping everything streamlined. It also addresses compliance from legal without the burden of managing a whole new domain.
What’s the end goal of creating a new domain? We have several non-employee accounts under our existing domain but with limited access. It might make sense to tidy up permissions instead of adding complexity to your domain setup.
Great point! Our leadership emphasized making a clear distinction, but I see how just refining our permissions could work better. Thanks!
I’ve worked with setups where we used addresses like @external.company.com for clarity. Launching a new domain can be costly and might lead to confusion, not to mention potential spam issues. Keeping it simple is usually best.
That's a neat idea! I'll definitely keep that in mind as it seems more straightforward.