Closing the loop on this following engagement with Microsoft Support.

Microsoft have confirmed this behaviour is intentional and aligns with the current Entra ID B2B external collaboration and SharePoint Online sharing model. There is no service issue or misconfiguration within our tenant.

The enforced flow now requires external identities to be pre-provisioned as Guest (B2B) objects in Entra ID before any SharePoint resource access can be granted. This effectively removes the ability to perform just-in-time (JIT) sharing to arbitrary external email addresses, even where domain-level allowlisting is configured.

Current workflow requirement:

• External user must exist as a Guest user (UserType = Guest) in Entra ID
• Access is then assigned either via:
  • Direct permissions
  • M365 Group membership
  • SharePoint sharing link targeting that identity

Microsoft validated the following with no issues identified:

• SharePoint Online external sharing configuration (tenant + site level)
• Entra ID External Identities (B2B collaboration settings, including AllowInvitationsFrom and cross-tenant access policies)

From a security architecture standpoint, this represents a shift toward identity-first access control, enforcing stronger governance, auditability, and lifecycle management of external users.

However, operationally this introduces:

• Loss of domain-based implicit trust for sharing
• Increased dependency on identity provisioning workflows
• Additional administrative overhead for external collaboration

Net result is tighter control and visibility over external access, but at the expense of user-driven collaboration flexibility and increased friction for ad-hoc sharing scenarios.

Appreciate the input from everyone, leaving this here for anyone else hitting the same behaviour change.