Guest accounts: lifecycle, inactive guests and access reviews
A guest is created in seconds, often by a user sharing a document or adding a partner to a team. Nobody thinks about removing it afterwards. In the tenants we audit, guests inactive for years, or who never accepted their invitation, are commonplace.
Who can invite
Entra ID external collaboration settings define who can send invitations. Options range from "anyone, including guests" to "no one", via "members and specific admin roles" or "only specific admin roles". The default is permissive.
There is no universal right answer: banning users from inviting anyone often pushes them towards workarounds (emailing attachments, unmanaged tools). What matters is that the choice is deliberate and, in any case, that guests themselves cannot invite other guests.
These settings are complemented by collaboration restrictions (allowed or blocked domains) and cross-tenant access settings, which let you vary the rules by partner organisation.
What guests can see
The guest user access setting offers three levels:
- Same access as members: the guest can browse the directory like an employee. Avoid it except in very specific cases.
- Limited access (the default): the guest can see the members of groups they belong to and some user properties.
- Restricted access: the guest can only see their own profile and the objects strictly necessary.
Restricted access is the target we recommend. It should be tested against the organisation's Teams and SharePoint usage, but it works in the vast majority of cases.
Check first. Guests holding an administration role or owning groups, teams or applications. We find these situations regularly, usually left over from a past engagement, and they give an external account control that it should not have.
Finding inactive guests
Two categories need dealing with:
- Invitations never accepted: the external user state shows acceptance pending. After a few weeks, the invitation no longer has any reason to exist.
- Inactive guests: the sign-in activity attribute, available through Microsoft Graph, gives the date of the last sign-in, interactive or not. A 90-day threshold is a common starting point, to be adjusted to your collaboration rhythms.
Read the dates with care: a guest may access a shared document without signing in often, and the attribute's history does not go back before it was introduced. As with devices, disabling before deleting leaves time to catch mistakes.
Access reviews
Access reviews automate the question "does this guest still need access?". Depending on your licences (Entra ID P2 or Entra ID Governance, to be checked for your agreement), they can cover:
- guests in Microsoft 365 groups and Teams, reviewed by the owners or by the guests themselves;
- all guests in the tenant, targeting inactive users;
- access to applications and access packages.
The key setting is the action applied to denied guests: block sign-in for a period, then delete the account. Without that automatic action, the review remains a paper exercise. For new collaborations, entitlement management goes further: the guest requests access through a package, with an expiry date and a named sponsor.
What an audit checks
- Invitation settings, and that guests cannot invite.
- The guests' level of access to the directory.
- Domain restrictions and cross-tenant access settings.
- The number of unaccepted invitations and inactive guests.
- Guests holding roles or owning objects.
- Access reviews covering guests, with an automatic action on denials.