How to Audit External Users in Microsoft 365
Every client collaboration, contractor engagement, and project team that used Teams or SharePoint leaves behind a guest account in your Microsoft Entra ID tenant. These accounts accumulate and are almost never reviewed. A business that has actively used Teams for three years typically has between 20 and 50 guest accounts - and a significant portion belong to people from concluded engagements whose access should have been removed months ago. Each one is an authenticated pathway into your environment that persists until someone explicitly removes it.
Why external users are a security risk
A guest user account in your Microsoft 365 tenant retains access to whatever it was granted access to - Teams channels, SharePoint sites, shared files - until that access is explicitly removed. A former client whose project ended twelve months ago may still have access to the project Teams channel, the SharePoint project site, and any files shared during the engagement.
Guest accounts are also a target for account takeover. If the guest user's email account (at their own organisation or personal provider) is compromised, an attacker can use those credentials to access your Microsoft 365 environment through the guest account. Unlike your internal users - who may be subject to Conditional Access policies requiring compliant devices or MFA - guest access policies are often more permissive.
How to find all external users in your tenant
Methods for identifying external users
- Microsoft Entra ID admin centre (entra.microsoft.com): go to Users, then filter by 'User type: Guest.' This shows all guest accounts in your tenant including their display name, email address, and when they were created. You can also see the 'Last sign-in' date to identify guests who have not authenticated recently.
- Microsoft 365 admin centre (admin.microsoft.com): go to Users then Guest users. This provides a summary view of guest accounts with the option to manage individual accounts.
- SharePoint admin centre: go to Policies then Sharing. Review the 'External sharing' reports to see which SharePoint sites have active external sharing and which external users have access.
- Microsoft Teams admin centre: go to Users and filter by external/guest to see guest users who have been added to Teams channels.
- PowerShell: for a complete export, use the Microsoft Graph PowerShell SDK to retrieve all guest users with their creation date, last sign-in date, and group memberships. This is the most comprehensive approach for a thorough audit.
Assessing which external access is legitimate
Once you have a list of guest users, the assessment question for each is: does this person still need access to our Microsoft 365 environment? This requires comparing the guest user list against active client relationships, current contractor engagements, and active project teams.
External user categorisation and action
| Guest user type | Assessment approach | Recommended action |
|---|---|---|
| Active client - ongoing engagement | Confirm engagement is current | Retain - review scope of access |
| Former client - engagement concluded | Check last sign-in date | Remove access, disable or delete account |
| Active contractor or consultant | Confirm current engagement status | Retain - verify access scope is appropriate |
| Former contractor | Check if contract has ended | Remove access immediately |
| Third-party vendor or supplier | Verify ongoing relationship | Retain if active, remove if relationship ended |
| Unknown - cannot identify the person | Investigate before action | Disable account pending investigation, then remove |
| Personal email (gmail.com, outlook.com etc.) | High risk - verify legitimacy | Review carefully - personal accounts have lower security than corporate accounts |
What to check before removing a guest user
- 1
Check what Teams channels the guest is a member of
In the Teams admin centre or via PowerShell, list all Teams channels the guest user belongs to. Confirm these are all from concluded projects before removing access.
- 2
Check SharePoint site access
Review which SharePoint sites the guest has been granted access to. This may include sites beyond the project Teams - standalone SharePoint sites shared directly.
- 3
Check for any shared files owned by the guest
In some configurations, external users can upload files to shared locations. Identify any content owned by the guest before deletion.
- 4
Notify internally if relevant
If the guest was a client contact, notify the internal account owner before removing access, in case there are active interactions that need to be transitioned.
Preventing guest user accumulation
A one-time audit removes the backlog, but guest accounts will accumulate again without a process to manage them. Two controls prevent this:
First, require approval for guest invitations. In Entra ID, configure the external collaboration settings to require that guest invitations are approved by a Global Administrator or a designated user. This prevents any staff member from adding external guests without oversight.
Second, configure access reviews for guest users. Entra ID P2 (included in E5, available as an add-on) includes access review automation. You can schedule quarterly reviews where guest users' sponsors are asked to confirm whether each guest still needs access - and guest access is automatically removed if no response is received. Entra ID P1 (included in Business Premium) supports manual access review exports but does not automate the review workflow.
A guest user audit in a business that has used Teams for client collaboration typically reveals 20 to 40 per cent more active guest accounts than expected. Many of these accounts belong to people from concluded client relationships who retain access to project SharePoint sites and Teams channels. Each one is an authenticated access pathway into your environment that can be exploited if the guest's own account is compromised.
Next step
Microsoft 365 Security & Governance Baseline
The Microsoft 365 Health Check includes a guest user audit, dormant account review, admin role assessment, and external sharing policy review - giving you a clear picture of who has access to your environment.
Learn more