Guests and external sharing in Microsoft 365: regain control without blocking collaboration
External sharing has become the norm in Teams and SharePoint, and with it the build-up of forgotten guests. You can regain control without slowing teams down: a few settings, a lifecycle and a regular review.
Collaboration came before governance
Teams and SharePoint made external sharing so easy that it spread everywhere: guests added for a three-week project and never removed, "Anyone" links travelling by email, team sites open to partners whose contract has ended. None of it is malicious. But after a few years, nobody knows who outside the organization has access to what.
The settings that matter in Entra ID
- Who can invite: everyone, members only, or designated roles. Letting guests invite other guests is rarely justified.
- What guests can see: the most restrictive level limits a guest to the properties and memberships of their own objects, with no directory browsing.
- Allowed domains: an allow list or block list of partner domains.
- Cross-tenant access settings: whether to trust the MFA and device compliance claimed by the guest's home tenant.
The settings that matter in SharePoint and OneDrive
The organization-level external sharing setting sets the ceiling: "Anyone" links with no authentication, new and existing guests, existing guests only, or internal only. Each site can be more restrictive than the organization, never more open. What to set:
- The default link type: "People in your organization" rather than "Anyone".
- A mandatory expiration date for anonymous links, if they remain allowed.
- A stricter ceiling on sites holding sensitive data, backed where possible by sensitivity labels.
A guest is not a risk in itself. The risk is the guest nobody remembers, who keeps access after the project ends.
Manage the lifecycle
The weak point is rarely the invitation and almost always the exit. Entra ID Governance access reviews periodically ask team or group owners to confirm each guest, with automatic removal when there is no answer. Without that licence, a regular report of inactive guests — no sign-in for 90 days, for example — and a clean-up procedure already cover most of the need.
What the frameworks ask for
NIS2, ISO 27001 and many customer questionnaires require control over third-party access: knowing who they are, what they can reach, and removing them when the relationship ends. A configuration audit provides exactly that evidence: invitation and sharing settings, number of guests and their last sign-in, active anonymous links, the most open sites.
What an audit checks
- External collaboration and cross-tenant access settings.
- External sharing level of the organization and of each site.
- Inactive guests, or guests who never signed in.
- Whether access reviews, or an equivalent procedure, exist.