An engineering firm cleans up 1,480 guest accounts in Entra ID with access reviews, a sponsor for every guest and a block-then-delete lifecycle
An engineering and design firm of about 260 staff with offices in Miami and Tampa, a leader in its segment.
- Scale
- 1,480 guest accounts before, 612 after, 1 sponsor per guest, 3 review types, 1 quarterly cycle, about 90 project teams
- Engagement
- Two weeks of discovery and design, a 30-day review cycle, then a 30-day block period before deletion
The challenge
Project teams invited consultants, subcontractors, owners' representatives and clients into Microsoft 365 to share drawings and schedules, and nobody removed them when the project closed. The tenant held 1,480 guest accounts, more than five for every employee. About 640 had not signed in for six months, many used personal mail addresses, and a few hundred had been invited by people who had since left the firm. A client's security questionnaire asked who outside the company could open its project files, and the firm could not give a defensible answer.
Guest accounts pile up because inviting someone takes seconds and removing them takes a decision. Each project adds a handful of consultants and clients, the project ends, and the accounts stay. After a few years the guest list is larger than the staff list, and no one can say who still needs what.
The fix is a way of giving every guest an owner, not a one-time purge. The sponsor model attaches a named employee to each external account, so that the question of whether this person still needs access always has someone to answer it. Access reviews then ask that person on a schedule, and the lifecycle of invite, review, block and delete means a wrong call can be undone within 30 days.
The block period is the part that makes people willing to act. Deleting 900 accounts at once would be a risk, but blocking them and waiting costs little, and the few that were needed came back within days with one request. In this illustrative case, that was 44 of 912, and the firm learned which projects were still active by who asked.
Accounts are only half of sharing. A guest can lose their sign-in and a link that anyone can open will still work, so the project paired the cleanup with a look at links, site ownership and labels. What the firm ended with was a number it could give a client and a process that keeps it true.
What our team delivered
- A guest inventory from the directory and the sign-in logs: when each account was invited, by whom, from which domain, last sign-in, which Microsoft 365 groups and Teams it belonged to and which SharePoint sites it could reach. About 640 guests had no sign-in in 180 days, 310 were invited by accounts that no longer existed and 95 belonged to no group at all
- A sponsor model. Every guest account gets a named sponsor in the directory, an employee who is accountable for why that person has access. Existing guests were assigned to the owner of the group or site they used most, and the 310 orphaned accounts went to project directors for a decision. New guests cannot be invited without a sponsor
- Access reviews in Microsoft Entra ID Governance, built after confirming which license the tenant held. Reviews cover guests in Microsoft 365 groups and Teams, with the group owner or the guest's sponsor as reviewer, last sign-in shown as a recommendation, a justification required to keep access and a 14-day window. Where no reviewer answers, access is removed. Reviews repeat every quarter
- A lifecycle of invite, review, block, delete rather than a straight deletion. After a review, guests who were not kept had their sign-in blocked for 30 days, during which a sponsor could restore access with one request. After the 30 days the accounts were deleted. Of 912 guests blocked, 44 were restored by a sponsor and 868 were deleted
- Tighter rules for new invitations: only members with a defined role and sponsors can invite, external collaboration is limited to an allow list of partner domains with an exception route, and guests see only a limited view of the directory. Consumer addresses are allowed only by exception, and cross-tenant settings let trusted partners sign in with their own organization's multifactor authentication
- Sharing hygiene alongside the accounts: a review of SharePoint sites shared with named guests, links that allow anyone with the link, and sites without an owner. Links were set to expire and sensitive project libraries were moved to sensitivity labels that restrict external sharing
- A one-page evidence pack for client questionnaires: the guest count by month, the review results, the sponsor coverage and a sample of removals, regenerated each quarter
Result
Guest accounts fell from 1,480 to 612, every remaining guest has a named sponsor who has confirmed the need within the last quarter, and no guest belongs to a group without an owner. The firm answered the client's questionnaire with a number and a process, and the first quarterly review took project directors about 20 minutes each. Deleting a guest ends access but does not recall a file the person already downloaded, and an access review is only as good as the reviewer's attention, which is why the sponsor and the last-sign-in recommendation are shown together. This is an illustrative engagement that describes the kind of work our team does; details are composite.
Get this for your company
Related services with fixed prices and a written scope.
Emergency package: security engineer in 1 hour
Is your company in a cybersecurity crisis? Purchase this package and a security engineer will call you within 1 hour.
Callback within 1 hour, 24 hours a day, 365 days a year
$1,950 per incident
Initial assessment of public endpoints
What an attacker can see and reach from the internet: your domains, mail, websites, remote access and cloud exposure.
Report within 5 business days of kickoff
$1,000 per assessment
Managed IT and security (MSP)
One monthly price per team member: help desk, device management, patching, backup monitoring and security basics.
Onboarding starts within 10 business days
$100 per team member, per month
Show 2 more
Managed security monitoring
Endpoint detection and response watched by our analysts, priced per device.
Agents deployed within 7 business days
$18 per endpoint, per month
Clayton Secure program
One monthly program that bundles monitoring, patching, backups, email protection and security awareness for your whole team. Priced per team member.
Onboarding starts within 10 business days
$150 per team member, per month
After you purchase, we contact you within 1 hour, any time of day or night, to start onboarding.
No payment is taken online. When we call you within the hour we confirm the scope and send an invoice (ACH, card or crypto).
Every sign-in, verified
Staff sign in once, but behind the scenes the device, the identity, a phone approval and your access policy are all checked before any app opens, and strangers are turned away.
The evidence pack and who asks for what
Twelve artefacts a firm can show about its AI use, and the party that most often asks for each: an insurer at renewal, an auditor or client questionnaire, or a regulator. A typical pattern only; the exact list depends on the policy, framework and sector.
Facing something similar?
Tell us about your environment. We will tell you plainly what we would do and what it would take.