Every Teams channel shared with a contractor, every SharePoint folder sent to an auditor, adds a guest account to your tenant. The project ends, but the guest account doesn’t. Entra access reviews for guest users are the built-in way to ask, on a schedule, “does this person still need access?” and to remove them automatically when the answer is no.
In the tenants I review, guest accounts are one of the most consistently neglected areas. This article covers why stale guests matter, what licensing access reviews need, and a setup that works for a 20 to 500 person business.
Why lingering guests are a real risk
Their security isn’t yours. A guest signs in with their home organization’s credentials. If their company has weak MFA or gets breached, the attacker inherits whatever access the guest still has in your tenant.
Access outlives the relationship. A former vendor can still open the shared Teams files from a project two years ago.
Nobody owns the cleanup. The person who invited the guest has often moved on, so no one notices.
Audits ask about it. Healthcare, legal and finance clients increasingly get asked by their own customers and insurers how external access is controlled.
Licensing: check this first
Access reviews are a Microsoft Entra ID Governance feature. The licensing has a few layers:
Need
License
Access reviews in general (reviewers and reviewed member users)
Microsoft Entra ID Governance or Microsoft Entra Suite; some capabilities work with Entra ID P2
Inactive user reviews and user-to-group affiliation recommendations
Microsoft Entra ID Governance
Governance features applied to guests, such as inactive guest reviews
Microsoft Entra ID Governance for guests add-on, billed monthly through a linked Azure subscription
Inactive guest insights report
Microsoft Entra ID Governance or Entra Suite
The guest add-on is billed per guest who has a governance action taken on them in a given month, and each guest is counted once per month no matter how many actions apply. To link a subscription, go to Entra ID > ID Governance > Dashboard and use the guest governance panel. Microsoft began enforcing the add-on for these features in January 2026.
If you don’t have Entra ID Governance, don’t skip the problem. There are cheaper controls covered later in this article.
Designing the review
The most effective pattern for small and mid-sized businesses is a recurring review of guests in Microsoft 365 groups and Teams, with group owners as reviewers. Owners know whether the outside person is still working with them.
Recommended settings
Go to Entra ID > ID Governance > Access reviews and create a new access review.
Review type: Teams and Microsoft 365 groups. Choose all Microsoft 365 groups with guest users, and exclude any groups you manage differently.
Scope: Guest users only.
Reviewers: Group owners, with a fallback reviewer (IT or the security owner) for groups without an owner.
Recurrence: quarterly, with a 14-day duration.
Upon completion: turn on Auto apply results to resource.
If reviewers don’t respond: Remove access. This is the setting that makes reviews actually work. If an owner can’t be bothered to confirm a guest, the guest goes.
Action for denied guests: block sign-in for 30 days, then remove the user from the tenant. The 30-day window lets you undo a mistake.
Turn on decision helpers so reviewers see last sign-in information.
Enable email notifications and reminders.
Multi-stage option
For organizations with a lot of guests, a two-stage review works well: stage one asks guests to self-attest whether they still need access, stage two has the group owner confirm. Guests who say they no longer need access, or don’t answer, are removed without bothering the owner.
Inactive guest review
If you have the governance add-on, also run a review scoped to inactive guests, defined by days since last sign-in (90 is a common choice). Accounts that haven’t signed in for three months are rarely missed. Newly created guests aren’t caught by default, so a recent invite isn’t removed before it is used.
Getting the rollout right
Clean up owners first. A review is only as good as its reviewers. Find groups with no owner or a departed owner and fix them before the first review.
Warn group owners. Send a short note explaining the review, what they’ll be asked and what happens if they ignore it.
Run the first review manually. Watch the results and the denied list before turning on auto-apply for recurring cycles.
Keep the audit trail. Review history is useful evidence for compliance questionnaires and NIST CSF assessments.
For regulated industries, guest governance is usually part of a broader NIST CSF assessment. Healthcare organizations will find it in our healthcare IT services work too.
If you don’t have Entra ID Governance
You can still keep guests under control with features most Microsoft 365 plans already include:
Restrict who can invite guests in External collaboration settings, for example only users in a specific role.
Allow-list or block-list domains so guests can only come from organizations you work with.
Turn on guest access expiration in SharePoint and OneDrive so shared links and guest access lapse automatically.
Require MFA for guests with Conditional Access, and decide whether to trust MFA from partner tenants in cross-tenant access settings.
Run a quarterly manual check of guest accounts’ last sign-in date and remove the ones that are clearly stale.
Apply sensitivity labels that block guest access to confidential Teams and sites. See our sensitivity labels service.
When a review cycle ends, spend a few minutes on the results rather than letting auto-apply do everything unseen. Look at three things. First, how many guests were removed because nobody responded; a high number means owners need a reminder about why the review matters. Second, which groups had the most denials; those are often old project Teams that can be archived entirely. Third, whether any guest was approved in several groups by different owners; that person may need a single, deliberate access package instead of scattered memberships. Write a two-line summary for the business owner each quarter. It shows the control is working and gives you evidence when a client or insurer asks how external access is governed.
Frequently asked questions
Do access reviews remove guests from SharePoint sharing links too?
A review of a Microsoft 365 group or Team removes the guest from that group. If you choose to block and then remove the guest from the tenant, any access granted directly to that account, including sharing links tied to it, stops working once the account is removed.
What happens if a group owner doesn’t respond?
That depends on the “if reviewers don’t respond” setting. I recommend Remove access, so an unanswered review leads to removal. Combined with reminders and a 14-day window, owners quickly learn to respond.
How often should guest access be reviewed?
Quarterly suits most businesses. Groups holding sensitive client or patient data may justify monthly reviews. Annual reviews tend to be too infrequent to catch projects that ended months earlier.
Not sure how many guests are sitting in your tenant? Request a free Microsoft 365 security assessment and we’ll count them, show you which are stale, and recommend a review setup that fits your licensing.
Every Teams channel shared with a contractor, every SharePoint folder sent to an auditor, adds a guest account to your tenant. The project ends, but the guest account doesn’t. Entra access reviews for guest users are the built-in way to ask, on a schedule, “does this person still need access?” and to remove them automatically when the answer is no.
In the tenants I review, guest accounts are one of the most consistently neglected areas. This article covers why stale guests matter, what licensing access reviews need, and a setup that works for a 20 to 500 person business.
Why lingering guests are a real risk
Licensing: check this first
Access reviews are a Microsoft Entra ID Governance feature. The licensing has a few layers:
The guest add-on is billed per guest who has a governance action taken on them in a given month, and each guest is counted once per month no matter how many actions apply. To link a subscription, go to
Entra ID > ID Governance > Dashboardand use the guest governance panel. Microsoft began enforcing the add-on for these features in January 2026.If you don’t have Entra ID Governance, don’t skip the problem. There are cheaper controls covered later in this article.
Designing the review
The most effective pattern for small and mid-sized businesses is a recurring review of guests in Microsoft 365 groups and Teams, with group owners as reviewers. Owners know whether the outside person is still working with them.
Recommended settings
Entra ID > ID Governance > Access reviewsand create a new access review.Multi-stage option
For organizations with a lot of guests, a two-stage review works well: stage one asks guests to self-attest whether they still need access, stage two has the group owner confirm. Guests who say they no longer need access, or don’t answer, are removed without bothering the owner.
Inactive guest review
If you have the governance add-on, also run a review scoped to inactive guests, defined by days since last sign-in (90 is a common choice). Accounts that haven’t signed in for three months are rarely missed. Newly created guests aren’t caught by default, so a recent invite isn’t removed before it is used.
Getting the rollout right
For regulated industries, guest governance is usually part of a broader NIST CSF assessment. Healthcare organizations will find it in our healthcare IT services work too.
If you don’t have Entra ID Governance
You can still keep guests under control with features most Microsoft 365 plans already include:
Microsoft’s guide to monitoring and cleaning up stale guest accounts walks through both the review and inactive insights options. And the Microsoft 365 security assessment includes a full count of guest accounts and their last activity.
Reading the results after each cycle
When a review cycle ends, spend a few minutes on the results rather than letting auto-apply do everything unseen. Look at three things. First, how many guests were removed because nobody responded; a high number means owners need a reminder about why the review matters. Second, which groups had the most denials; those are often old project Teams that can be archived entirely. Third, whether any guest was approved in several groups by different owners; that person may need a single, deliberate access package instead of scattered memberships. Write a two-line summary for the business owner each quarter. It shows the control is working and gives you evidence when a client or insurer asks how external access is governed.
Frequently asked questions
Do access reviews remove guests from SharePoint sharing links too?
A review of a Microsoft 365 group or Team removes the guest from that group. If you choose to block and then remove the guest from the tenant, any access granted directly to that account, including sharing links tied to it, stops working once the account is removed.
What happens if a group owner doesn’t respond?
That depends on the “if reviewers don’t respond” setting. I recommend Remove access, so an unanswered review leads to removal. Combined with reminders and a 14-day window, owners quickly learn to respond.
How often should guest access be reviewed?
Quarterly suits most businesses. Groups holding sensitive client or patient data may justify monthly reviews. Annual reviews tend to be too infrequent to catch projects that ended months earlier.
Not sure how many guests are sitting in your tenant? Request a free Microsoft 365 security assessment and we’ll count them, show you which are stale, and recommend a review setup that fits your licensing.