Forgotten Guest Accounts in Microsoft 365: Find and Remove Them

Microsoft 365 does not remove a guest account when the project it was created for ends. If nobody owns your guest list, former contractors, suppliers and clients can keep signing in to your Teams and SharePoint sites long after the work is finished.

The short answer

Every guest in your tenant should have three things: a named person inside your organisation who is responsible for them, a reason they still need access, and a date when that reason will be checked again. Guests without all three should be disabled and then removed.

Microsoft gives you the tools to do this, from a simple report of guests who have not signed in for a while to automated access reviews. The tools only help if someone has the job of using them.

How guest accounts pile up

Guest accounts are created quietly, as a side effect of ordinary collaboration:

• A Team for a client project. Someone adds the client's project lead so they can see the shared files. Microsoft 365 creates a guest account in your directory.
• A file shared with a supplier. Depending on your sharing settings, sharing a SharePoint or OneDrive file with an outside address can also create a guest.
• The consultant for a migration or an audit. They needed access for a few weeks. The engagement ended months ago.
• The freelancer who changed companies. Their guest account still points to an email address, and whoever controls that address now controls the sign-in.

None of these is a mistake. The problem is that adding a guest takes seconds, while removing one is a job nobody is assigned. Microsoft's own documentation says it plainly: guest accounts are not removed when collaboration ends, and they can become stale.

What a stale guest can still reach

A guest account keeps whatever it was given. If a former contractor was a member of a Team, they may still be able to open that Team's channels and the SharePoint site behind it. If they were added to a group that has access to other sites, they may reach those too.

The risk is not usually the original guest acting in bad faith. It is the account itself: a sign-in your organisation does not watch, protected by security settings you do not control, attached to a mailbox at another company. If that outside mailbox is compromised, an attacker may inherit a quiet way into your files.

There is also the simpler problem of trust. When a client asks who outside your company can see their documents, "we are not sure" is a difficult answer to give.

Finding inactive guests

Start by finding out how many guests you have and when each one last signed in. In the Microsoft Entra admin center you can filter users by type to list every guest, and the sign-in activity on each account shows when it was last used.

Microsoft also provides a report of inactive guest accounts. By default it treats a guest as inactive after 90 days, counted from their last sign-in, or from the date the account was created if they have never signed in at all. The threshold can be changed to suit your organisation.

A guest who has never signed in is often the easiest decision: the invitation was sent, nobody accepted it, and the account has been sitting in your directory ever since.

Access reviews: letting the owners decide

Once you know who your guests are, the next question is who decides whether each one stays. Microsoft Entra access reviews put that decision in front of the right person, such as the owner of the Team or group the guest belongs to, on a schedule.

A review of inactive guests can be set to act on the results. Guests who are denied are disabled and blocked from signing in for 30 days, then deleted. A deleted guest can still be restored for a further 30 days if the decision turns out to be wrong.

Check your licences before you plan around this. Reviewing and removing inactive guests in this way needs Microsoft Entra ID Governance or Microsoft Entra Suite. Governance features used for guests are billed per guest monthly active user, through an add-on linked to an Azure subscription. If those licences are not in your plan, the same routine can still be run by hand from the inactive guest report, just with more effort.

A guest-access routine you can keep

1. Count your guests. List every guest account and note when each one last signed in.
2. Give each guest an owner. Usually the person who invited them, or the owner of the Team they belong to.
3. Write down the reason. One line per guest: which project, which client, which contract.
4. Disable before you delete. Block sign-in for guests nobody can explain, wait a few weeks for anyone to object, then remove them.
5. Clean up the obvious ones first. Guests who never accepted their invitation, and guests from engagements you know have ended.
6. Review your sharing settings. Decide who in your organisation is allowed to invite guests, and whether guests need multifactor authentication to sign in.
7. Put the review in the calendar. Quarterly is a sensible starting point. Guest lists grow back quickly if nobody looks.

Frequently asked questions

Does Microsoft 365 delete guest accounts automatically?

Not by default. A guest account stays in your directory until someone removes it. Automated clean-up is possible with access reviews or lifecycle policies, but these need Microsoft Entra ID Governance licensing and have to be set up.

How do I see all the guest users in Microsoft 365?

In the Microsoft Entra admin center, open the list of users and filter by user type to show guests. Each account shows its last sign-in, and the inactive guest report highlights accounts that have not been used for 90 days by default.

Can a guest still open our files after we remove them from a Team?

Removing a guest from one Team removes access to that Team, but the guest account itself remains. If it was added to other Teams, groups or sites, or files were shared with it directly, that access stays until the account is disabled or deleted.

What happens when a guest account is deleted by mistake?

A deleted guest can be restored from the deleted users list for 30 days. After that it is gone, and the person would need to be invited again.

Should guests be required to use multifactor authentication?

For most organisations, yes. A guest signs in with security controlled by their own company, so requiring MFA when they access your resources adds a check you control. Plan it with your clients and suppliers so nobody is locked out mid-project.

Where to start

Counting your guests takes a few minutes, and it usually tells you whether there is a problem. If the list is longer than you expected, we can help you match each guest to an owner, disable the ones nobody can explain, and set up a review that keeps the list short. Guest access sits alongside administrator roles as one of the first things worth checking; see our article on cutting back Global Administrators.

Onprem2Cloud IT Solutions Co. is a Microsoft CSP partner based in Muntinlupa City, Metro Manila. See our cybersecurity services or send us an enquiry.