Start free trial
Start free trial
How-to 5 steps 3 min read Updated 11 November 2026

How to manage guest users across Microsoft 365

Manage guests from invitation to removal, with rules for who may invite them, who sponsors them, when access is reviewed and how it ends.

Torsten Mandelkow Works with
How-to

What is guest user management in Microsoft 365?

Managing guest users in Microsoft 365 means controlling the full lifecycle of an external person's access: who may invite them, which workspaces they join, who sponsors them, when their access is reviewed and how it ends.

In short

  • Guests are invited for a project, and the invitation rarely ends with the project.
  • Every guest needs a sponsor inside your organization who answers for them.
  • Guests sit in Teams, SharePoint sites and groups, so review them across all three.
  • Unaccepted invitations and inactive guests are the cheapest risk to remove.

Step by step

Five steps cover the guest lifecycle from invitation to removal.

  1. Decide who can invite

    Set the guest invitation rules in Microsoft Entra ID so that only the roles you choose can invite, and decide which email domains are allowed or blocked.

  2. Require a sponsor and a reason

    Record for every guest who sponsors them and which project or workspace they belong to. A guest with no sponsor is a finding the first time you look.

    Tip: Put an end date on guests invited for a time-limited project.

  3. Get one view of guests across workloads

    List guests with the Teams, SharePoint sites and Microsoft 365 groups they are members of, and flag any guest who owns a group or a site. Include invitations that were never accepted.

    In Rencore:

  4. Review on a cycle

    Send each workspace owner or guest sponsor a review of their guests every quarter, and monthly for workspaces with sensitive data. Remove access that is not confirmed.

    In Rencore:

  5. Remove and keep the evidence

    Remove guests who are inactive, whose project has ended or whose invitation stayed open, and record who decided and when, so you can show external access was controlled.

Why guest access outlives the work

Inviting a guest takes a minute and ending the access takes a decision that nobody is assigned to make. Guests invited for one project keep their access after it closes, and invitations that were never accepted sit open for months.

Guests also reach further than the invitation suggests. A guest added to a Team can see its channels and files, and an external user who owns a group or a site collection means control over your data sits outside your organization.

Connectors in this How-to

Each connector page in the Rencore docs lists the objects, policies, reports and actions behind these steps.

Common questions about guest users in Microsoft 365

Who should be allowed to invite guests?
Decide this on purpose rather than leave the default. Many organizations let any member invite guests, then find nobody can say who invited whom. A workable middle is to let team and site owners invite, require each invitation to name a sponsor, and send invitations for sensitive workspaces through an approval. The aim is that every guest has a person inside your organization who answers for them.
What happens to a guest when their project ends?
By default, nothing. A guest keeps access until someone removes it, which is why guests are among the most common leftovers in a tenant. Tie each guest to a project or an expiry date when you invite them, review guests on a cycle, and remove access that the sponsor does not confirm. The inactive guest case has its own How-to, linked below.
Do Entra ID and the Microsoft 365 admin center already cover guests?
They cover the controls: external collaboration settings, guest invitation rules, and the guest user list, with access reviews available in Microsoft Entra ID Governance. They are built around Entra ID, so they do not by themselves show you which Teams, SharePoint sites and groups guests are in, or who owns a group that a guest controls. You combine the settings with a view across workloads.
How does Rencore help manage guests?
Rencore Governance reports on guests and external users across Teams, SharePoint, Microsoft 365 groups and Entra ID. It identifies every Team with external users or guests, counts internal users, external users and disabled accounts side by side, and surfaces invitations that were never accepted after three months. It follows the three month trend, so you see external access growing or shrinking.

Last updated 11 November 2026

About the author

Torsten Mandelkow

Torsten is co-founder and CAA at Rencore. During his time as a SharePoint consultant, he always tried to improve and automate the SharePoint development process, first by creating the SharePoint Software Factory (SPSF), and later by creating the SharePoint code analysis tools, today known as SPCAF. After an intermezzo for 3 years at Microsoft, he is now part of the RENCORE team and is responsible for the further technical development of all our tools.

Related

See every guest and where they have access

We will show the external access overview, the guests per Team and the unaccepted invitations in a short demo.

Request a demoGet started free
Rencore newsletter

Subscribe to our newsletter

Get the latest insights on governing Microsoft 365, Copilot and AI agents, delivered to your inbox.

Loading form