Guest access reviews in Entra ID clean up years of forgotten accounts

In many Microsoft 365 tenants I find the same thing, a pile of guest accounts that has grown quietly over the years. Sharing through Teams or SharePoint is so easy that hardly anyone keeps track of which external users still need access, or even who they are. I regularly run into guests who have never signed in or who belong to projects that ended long ago. Sooner or later someone asks who actually controls all this, usually when an audit or a compliance check is coming up. Guest access reviews in Entra ID are the tool I use to bring order back, and getting there doesn't take many steps.

A guest inventory comes before any access review

Before I set up access reviews, I want a baseline. How many guests are there, and how active are they? The Entra ID user list often holds unpleasant surprises, and the total is usually far higher than anyone expected. Counting alone doesn't get you far, though. What matters is which accounts have signed in recently. The “signInActivity” property in Microsoft Graph helps a lot here because it shows when a guest account was last actually used. On top of that there are usually plenty of pending invitations, which you can typically remove or let expire without risk.

This is a quick way to build that inventory with Microsoft Graph PowerShell:

Connect-MgGraph -Scopes 'User.Read.All'
Get-MgUser -Filter "userType eq 'Guest'" -Property DisplayName,UserPrincipalName,SignInActivity |
  Select-Object DisplayName,UserPrincipalName,@{Name='LastSignIn';Expression={$_.SignInActivity.LastSignInDateTime}}

The output lists every guest account with its last sign-in timestamp. A blank LastSignIn usually means the invitation was never accepted or the account was forgotten long ago. If you want the mechanics in more detail, the Microsoft overview of access reviews is a good place to start.

Access reviews can target all guests or specific groups and Teams

With the inventory done, I start the actual access reviews for guests. Entra ID can scope a review to every guest in the tenant or only to guests in specific Microsoft 365 groups or Teams. You also pick the reviewers. That can be group owners, designated sponsors (internal users responsible for the guest), or the guests themselves for self-attestation. The setup I find most practical is a recurring review with auto-apply. Denied guests are removed without any manual work, and non-responders can be handled automatically as well.

Some patterns that have worked well for me:

• Reviewing all guests in a sensitive group or Team
• Running tenant-wide guest access reviews (e.g., quarterly)
• Focusing reviews on particularly critical projects or data

In large organizations it helps to stagger the reviews or pilot them with a few selected groups first, which keeps adoption manageable. The Entra portal walks you through the setup, and the how-to documentation explains the options clearly if you want to look at them in detail.

Auto-apply turns review results into blocked and deleted accounts

Acting on the results is the part of access reviews that people overlook most often. Entra ID can automate the outcome. If access is denied or a guest doesn't respond, sign-in can be blocked right away. You can also configure a delay (say, 30 days) before the account is deleted for good. That saves time and gives guest accounts a predictable lifecycle.

The diagram below shows the typical review and cleanup flow:

flowchart TD
  Start["Start Access Review"] --> Review["Reviewer decision"]
  Review -->|"Access confirmed"| Keep["Keep access"]
  Review -->|"No response"| Block["Block sign-in"]
  Review -->|"Access denied"| Block
  Block --> Wait["Wait 30 days"]
  Wait --> Delete["Delete guest"]

Figure: Typical guest access review flow with automatic blocking and delayed deletion.

In many environments I've worked in, automatic blocking and deletion after a denial or non-response has made a big difference. The condition is that you walk through the process with compliance and the business owners first.

Licensing and invitation rights deserve attention early

Keep licensing in mind from the start. Access reviews require at least Entra ID P2 or Entra ID Governance licenses. People often ask me who exactly needs a license. According to Microsoft, both the reviewers and the reviewed users (that is, the guests under review) must have the appropriate license. If you're planning a large rollout, build licensing into the plan from the beginning.

A related problem is that many tenants I see are far too permissive about who may invite external users. New guests keep arriving, and cleanup gets much harder as a result. The external collaboration settings let you control precisely who can invite guests and what rights they get. In my experience, tightening these settings is often the quickest way to slow the steady flow of new guest accounts.

Quick tip: Before you launch access reviews for all guests, clean up the invitations that were never accepted and set clear rules for who may invite guests in future. That saves licensing costs and spares you trouble later on.

Regular clean-ups pay off in my experience

If you use Teams or SharePoint for external collaboration, guest access reviews aren't optional. You need them. They show you who still has access, which lowers the risk and keeps your environment from becoming a security liability. In the tenants I work with, regular automated reviews (together with enforced external collaboration settings) have been a big step forward. As usual, though, the technology isn't what makes the biggest difference. Discipline and clear processes, kept up over time, are what really count.