Best Practices for M365 Guest Access Management: A Complete Guide

The Challenges of M365 Guest Access

Collaborating with external partners, vendors, and clients via B2B Collaboration is one of the most valuable capabilities of Microsoft 365, particularly through Microsoft Teams and SharePoint Online. However, enabling external collaboration introduces significant governance and security challenges. If left unmanaged, guest access can quickly lead to data leaks, compliance violations, and a cluttered directory filled with forgotten external accounts.

There are two major risks when Guest Access is not properly managed:

• Orphaned Guests: External users who were invited to support a short-term project that concluded months or even years ago. Their accounts remain active in your directory, potentially retaining access to sensitive internal files.
• Oversharing: Employees may unintentionally overshare information by granting guests access to entire Teams or SharePoint sites when they only needed access to a single document or folder.

Governance Maturity Model

Organizations typically progress through several stages of maturity regarding Guest Lifecycle Management:

Guest Lifecycle Architecture

A mature governance framework visualizes the guest lifecycle from invitation to removal:

Top Foundational Controls for Microsoft 365 Guest Governance

To secure your tenant while maintaining productivity, implement these essential guest access governance controls under the Entra ID External Identities framework:

1. Restrict Guest Inviter Permissions

By default, Microsoft Entra ID allows any user to invite guests to your directory. While convenient, allowing any user to invite guests may increase governance and compliance risks in larger organizations. You should restrict this capability so that only administrators or specific users assigned to the Guest Inviter role can invite external users.

2. Lock Down Guest Permissions in Entra ID

Guest users shouldn’t be able to enumerate your directory. In the Entra ID External Collaboration settings, ensure that guest user access is restricted. Set the option to: “Guest user access is restricted to properties and memberships of their own directory objects.” Organizations operating under zero-trust principles should apply the most restrictive guest permission model unless a business requirement dictates otherwise.

3. Conditional Access for Guests

Identity governance must be paired with authentication governance. Rather than treating guests like internal employees, create specific Conditional Access for Guests policies:

• Require MFA: Mandate Multi-Factor Authentication for all external users.
• Device Restrictions: Restrict access from unmanaged or non-compliant devices.
• Block Legacy Auth: Ensure modern authentication is strictly enforced.

4. Cross-Tenant Access Settings

For enterprise customers, managing B2B collaboration at scale requires configuring Cross-Tenant Access Settings. Instead of forcing partner users to register for MFA again in your tenant, you can configure inbound trust settings to:

• Trust MFA claims from the partner’s Entra ID.
• Trust compliant device claims from specific partner tenants.
• Allow B2B collaboration only with approved partner domains (B2B Allow List).

5. Mitigate Personal Email Risk

Auditors frequently flag external sharing to consumer email addresses (e.g., @gmail.com or @yahoo.com). Collaborating with a corporate identity (@partner-company.com) offers better accountability. Consider configuring a B2B Allow/Deny list to block free-mail domains or strictly reviewing guest accounts originating from personal email providers.

6. Utilize Sensitivity Labels for Teams and Sites

Not all SharePoint sites or Microsoft Teams should allow guest access. Use Microsoft Purview Sensitivity Labels to classify your containers. Sensitivity labels provide consistent governance because the policy travels with the Microsoft 365 Group, Team, and SharePoint site rather than relying solely on user behavior.

7. Implement Access Reviews & Expiration Policies

If your organization has Microsoft Entra ID P2 licenses, take advantage of Access Reviews. If access is denied or the review is not completed, Microsoft Entra can automatically remove the guest from the reviewed group or application assignment.

For a simpler approach, utilize Microsoft 365 Group Expiration Policies. Set a group lifecycle (e.g., 180 days), after which the owner receives a notification to either renew the group or let it expire—effectively curtailing indefinite guest access to that workspace.

Decision Matrix

Automating Guest Lifecycle Management with PowerShell

PowerShell and Microsoft Graph provide a practical alternative for organizations without Microsoft Entra ID Governance licensing. Below are robust scripts to audit, report on, and clean up your directory.

Script 1: Find Inactive Guests

This script retrieves guest users and evaluates their latest available sign-in activity. Note: Retrieving SignInActivity requires an Entra ID P1/P2 license. Not all tenants can retrieve historical sign-in data, and properties may return null if no activity is found within the audit retention window.

# Connect to Microsoft Graph with required scopes
if (-not (Get-MgContext)) {
    Connect-MgGraph -Scopes "User.Read.All", "AuditLog.Read.All"
}

$inactiveDays = 90
$cutoffDate = (Get-Date).AddDays(-$inactiveDays)

# Retrieve all Guest users
$guestUsers = Get-MgUser -Filter "userType eq 'Guest'" `
    -Property Id, DisplayName, Mail, CreatedDateTime, SignInActivity -All

$inactiveGuests = @()

foreach ($user in $guestUsers) {
    # Prioritize LastSuccessfulSignInDateTime to ignore failed login attempts
    $lastSignIn = $user.SignInActivity.LastSuccessfulSignInDateTime
    
    # Check if user has never signed in (and was created before cutoff) 
    # OR signed in before cutoff
    if (($null -eq $lastSignIn -or $lastSignIn -lt $cutoffDate) `
        -and $user.CreatedDateTime -lt $cutoffDate) {
        
        $inactiveGuests += [PSCustomObject]@{
            DisplayName = $user.DisplayName
            Email       = $user.Mail
            Created     = $user.CreatedDateTime
            LastSignIn  = if ($lastSignIn) { $lastSignIn } else { "Never" }
            Id          = $user.Id
        }
    }
}

# Export the results
$inactiveGuests | Export-Csv -Path "C:\temp\InactiveGuests.csv" `
    -NoTypeInformation -Encoding UTF8
Write-Host "Found $($inactiveGuests.Count) inactive guest users." -ForegroundColor Yellow

Script 2: Safely Disable Inactive Guest Users

Warning: Permanently deleting a user is an aggressive action. A best-practice lifecycle approach consists of two phases: First, disable the account (Phase 1). Then, after a 30-day grace period, permanently remove them (Phase 2).

The script below executes Phase 1 by temporarily disabling the accounts found in your CSV:

# Connect to Microsoft Graph
if (-not (Get-MgContext)) {
    Connect-MgGraph -Scopes "User.ReadWrite.All"
}

# Import the reviewed CSV file
$guestsToDisable = Import-Csv -Path "C:\temp\InactiveGuests.csv"

foreach ($guest in $guestsToDisable) {
    try {
        # Phase 1: Disable the account instead of hard-deleting
        Update-MgUser -UserId $guest.Id -AccountEnabled:$false
        Write-Host "Successfully disabled guest: $($guest.Email)" -ForegroundColor Green
    }
    catch {
        Write-Host "Failed to disable guest: $($guest.Email). " `
            "Error: $($_.Exception.Message)" -ForegroundColor Red
    }
}

Script 3: Report Guests by Domain

Auditors and security teams often need to know which partner domains have the highest footprint in your tenant. This script aggregates guest counts by email domain.

if (-not (Get-MgContext)) {
    Connect-MgGraph -Scopes "User.Read.All"
}

$guests = Get-MgUser -Filter "userType eq 'Guest'" -Property Mail -All
$domainReport = @{}

foreach ($guest in $guests) {
    if ($guest.Mail) {
        $domain = $guest.Mail.Split('@')[1].ToLower()
        $domainReport[$domain]++
    }
}

$domainReport.GetEnumerator() | Sort-Object Value -Descending | `
    Select-Object @{Name="Domain";Expression={$_.Name}}, `
                  @{Name="GuestCount";Expression={$_.Value}} | `
    Format-Table

Conclusion

Guest access management is not a set-it-and-forget-it task; it requires continuous governance. By restricting inviter permissions, enforcing Conditional Access, utilizing sensitivity labels, and establishing a robust lifecycle routine via PowerShell or Access Reviews, you can drastically reduce your attack surface and prevent oversharing.

While Microsoft provides strong native governance capabilities, many organizations still struggle with identifying orphaned permissions across large SharePoint environments. Tools such as SPClean can help automate discovery and remediation at scale, reducing the operational overhead associated with manual reviews and PowerShell scripts.