Microsoft Entra Access Reviews and the Guest Account Lifecycle: Invite, Review, Block, Delete

Why guests are a quiet risk

Microsoft Entra ID is Microsoft's cloud identity service behind Microsoft 365. When you invite someone outside your company to a Team, a SharePoint site or an app, Entra creates a guest account for them. That is useful: you do not have to create a full employee account for a bookkeeper, an architect or an outside counsel. The risk is time. The project ends, the contract ends, the person changes jobs, and the guest account and its access stay.

Microsoft's documentation describes the same pattern: end users often start the invitation process, the need to collaborate drives owners to invite, and without a regular check, external users keep access they no longer need. Excess access is how a compromised outside account, or an old one, becomes a way into your files.

The lifecycle in four steps

• Invite. Decide who may invite guests and to what. Keep it to people who own the resource, and set tenant rules for external collaboration so that a guest cannot see more of your directory than needed.
• Own. Every team or group that has guests needs at least one active owner. An unowned group has no one to answer a review.
• Review. On a schedule, ask the owner whether each guest still needs access. Quarterly is a common starting point; sensitive sites can be more often.
• Remove. When a guest is denied or no longer needed, remove the access, and after a waiting period, remove the guest account.

Setting up a guest review

In the Entra admin center under Identity Governance, you create an access review. For guests, the common scope is Teams and groups. Microsoft's documentation offers an option for all Microsoft 365 groups with guest users, which creates recurring reviews across your Teams and Microsoft 365 groups; it says dynamic groups and role-assignable groups are not included, so treat those separately. You can also pick a specific list of groups, and you can exclude some.

Then choose who reviews. The options include the group owners, specific people, the users themselves, or the users' managers. For guests, owners are usually best. Microsoft notes that if you pick users reviewing their own access or managers of users, certain direct-connect users cannot review themselves in your tenant, so test the choice. Set the duration, meaning how many days the review stays open, and the recurrence. Turn on the justification option so reviewers write a reason, which helps later if someone asks why access was kept.

The setting you must think about: if reviewers do not respond

Under completion settings, Entra lets you choose what happens to users nobody reviewed: no change, remove access, approve access, or take recommendations. It also has an option to apply results automatically when the review ends. Microsoft's own warning applies here. If you pick remove access or take recommendations and also apply results automatically, all access to the resource could be revoked if reviewers do not respond.

Our usual advice is to start with no change for the first one or two cycles, so you see who answers and who does not, then escalate. Add a fallback reviewer, turn on reminders, and move to removal for non-responders only when owners are used to the process.

Reviews that let guests speak for themselves

One option is to have the guests confirm their own access. The guest approves or does not approve in the My Access portal. That is a quick way to clean out guests who no longer work with you, but it does not replace an owner's view of whether the access is appropriate, so use it alongside owner reviews for sensitive data rather than instead of them.

Block first, then delete

For a review scoped to guest users only, the option for denied guests includes blocking them from signing in for 30 days and then removing them from the tenant. Microsoft explains that the review then stays in an applying state for 30 days, and during that time you cannot view or configure settings, results, reviewers or audit logs for that review. That is a safety net: a wrongly denied guest can be noticed and restored before the account is gone.

Before you delete externals who have no access to anything, Microsoft suggests contacting them, in case you overlooked standing access they still need.

Inactive guests and privileged roles

Reviews can also target users based on inactivity, which Microsoft says needs an Entra ID Governance license. Recommendations are based on when the user last signed in. For administrative roles, role assignments such as Global Administrator can be recertified in Privileged Identity Management. If a guest ever holds an admin role, that should be a rare, documented exception with a short end date.

A plain checklist

• List guests today: who invited them, what they can reach, when they last signed in.
• Assign owners to every group and team that has guests.
• Create one recurring review for guests across Microsoft 365 groups, plus separate reviews for sensitive sites and apps.
• Start with no change for non-responders, then tighten.
• Use block for 30 days then remove for denied guests.
• Write down the exception rule for long-term vendors, with a named internal sponsor.
• Keep review results as evidence for auditors and insurers.

We design and run guest and identity governance for Microsoft 365 tenants as scoped work: a one-time cleanup, then reviews that run on a schedule and report to the right owners. We do not resell licenses on this page, and your Microsoft agreement decides which features you can use.

Sources

• What are access reviews? (Microsoft Learn)
• Manage guest access with access reviews (Microsoft Learn)
• Create an access review of groups and applications (Microsoft Learn)
• Microsoft Entra ID Governance licensing fundamentals (Microsoft Learn)
• What is B2B collaboration in Microsoft Entra External ID (Microsoft Learn)

This article is general information, not legal or technical advice for your environment. Product menus, license names and provider rules change; check the vendor's current documentation before you act. Last reviewed November 9, 2026.

Next article

Next · SecurityBIMI, VMC and CMC Explained: A Logo in the Inbox, What It Needs and What It Does Not ProveBIMI lets mailbox providers show your logo next to mail that passes strict authentication. It is a reward for finishing DMARC, not a security control by itself. Here is what you must have first, the difference between a VMC and a CMC, and the limits of what a logo proves.7 min read

Related reading

• SecurityProtecting Unreleased Content: Access Control, Watermarking and Freelancer Accounts for Media Production8 min
• SecurityEntra ID Protection Risk Policies: User Risk, Sign-In Risk, Licensing and Self-Remediation8 min