Guest accounts in Microsoft 365: what an SME should decide

What a guest account is — and what it is not

In Microsoft Entra ID (formerly Azure Active Directory) a guest is an external user you invite into your directory. That person usually keeps an account at their own organisation or a personal Microsoft identity; you grant rights on Teams, SharePoint sites, OneDrive folders or apps. A named-user employee has a licensed membership in your tenant (mail, OneDrive, often broader access). A guest is meant for temporary or limited collaboration — not as a quiet substitute for a permanent hire without onboarding.

In practice: guests appear in your directory, can join channels and open files someone shares. They do not disappear on their own when the project ends.

Why uncontrolled guests linger

Inviting is one click; cleanup needs attention. After a job, guest accounts stay in Teams channels, private channels, SharePoint permissions and shared OneDrive folders. “Anyone with the link” sharing makes it harder to see who can still reach which folder. Oversharing is rarely malice — it is haste, no review, and nobody owning “guest offboarding” as a task.

See also our pieces on SharePoint and OneDrive external sharing and admin accounts: who may invite belongs with privilege — not “everyone is admin or guest owner”.

What you should decide in writing

Keep it short enough to decide this quarter:

• when guests are allowed (project, supplier, temporary specialist) — and when not;
• who may invite (for example only IT or the MSP, not every Teams owner without an agreement);
• which sites, Teams and folders are open to guests by default — and which stay internal;
• expectations around multifactor authentication for guests, where your licences and Conditional Access allow it;
• review cadence: for example quarterly walk through the guest list;
• offboarding: who removes or blocks the guest when the engagement ends — tied to your joiner and leaver checklist.

Write those points on one page. That is your guest policy; the tenant follows that text. For MFA on ordinary users and guests see also turning on MFA in Microsoft 365.

What Floor ICT configures — and what you decide

In the Microsoft 365 tenant we typically: set guest invite settings (who may invite, whether guests can invite others), align SharePoint and OneDrive external sharing with your policy, run a periodic guest inventory, and include guests in joiner/leaver processes beside named users. We help remove surplus guests and tie review to a fixed cadence.

You still decide: whether partners get guest access at all, which Teams are open, and how strict the review is. Technical toggles without policy do not fix “old project guests in the HR folder”; policy without configuration does not either.