How do we govern guest users in Microsoft 365?

Key facts

• Guests are Entra ID B2B accounts and can reach anything they are shared into.
• Conditional Access policies can and should cover guest users, including MFA.
• Access reviews need Entra ID P2 or Entra ID Governance licensing.
• SharePoint guest expiration forces reshares after a set period.
• Stale guests are found through sign-in activity, not by guessing.

Know what a guest can reach

When someone outside the organization is added to a team, a SharePoint site or a shared file, Microsoft Entra ID usually creates a B2B guest account for them. That account can sign in to anything it has been granted: teams, sites, Planner plans, Power BI reports and apps. Over time, guests collect access that nobody remembers granting.

Start with an inventory. In the Entra admin center, filter users by user type Guest, and export with last sign-in date, creation date, inviter and group memberships. Microsoft Graph PowerShell makes this repeatable.

Control who can invite

Entra ID external collaboration settings decide who can send invitations. Options range from anyone in the organization, including guests, to only admins and users in the Guest Inviter role. Most SMB and mid-market organizations let members invite but stop guests from inviting other guests.

• Restrict guest user access so guests cannot browse the directory or see other users and groups.
• Use the domain allow or deny list to limit collaboration to known partners if that fits your business.
• Use cross-tenant access settings to trust MFA and device claims from specific partner tenants.
• Turn on email one-time passcode so guests without a Microsoft account can still sign in securely.

Protect guest sign-ins

Create a Conditional Access policy that targets guest and external users and requires MFA. Without it, a guest with a weak password at their own company can become a way into your data. If you trust a partner tenant's MFA through cross-tenant access settings, guests from that tenant are not prompted twice.

Consider terms of use for guests in regulated environments, and block guests from admin portals and sensitive apps. Guests should also be covered by sign-in risk policies if you hold Entra ID P2.

Remove access that is no longer needed

Guest governance mostly comes down to removing access reliably. Pick the mechanisms that fit your licensing.

Make the process stick

Write a short guest policy: who can invite, what guests may access, how long access lasts and who reviews it. Give every team and site an owner who answers for its guests. Report the guest count and stale guests to IT leadership each quarter.

For a first cleanup, disable guests with no sign-in for a long period, wait a few weeks for complaints, then delete. That gives a safe rollback if someone was still needed. Tell team and site owners before the cleanup starts, so a partner who suddenly cannot open a project site does not become an urgent ticket on a Friday afternoon. Repeat the inactive guest report on a schedule, since new guests arrive every week.

How Accred Consulting approaches it

Accred Consulting sets up guest governance as part of identity and SharePoint governance work. Discovery exports current guests, sign-in activity, invitation settings and where guests have access. The proposal sets a clear scope, fixed price and timeline. US-based specialists then configure external collaboration and cross-tenant access settings, guest MFA, SharePoint guest expiration, and access reviews or access packages where licensed, and run the first cleanup in a safe disable-then-delete sequence. Handover includes the guest policy, documentation and knowledge transfer.

Track record: 475+ client projects, 2,000+ migration workstreams and 210,000+ users migrated by a US-based team. Company facts · Case studies

Related questions