In many of the Microsoft 365 environments I work in, onboarding an external user still means sending an email invitation and hoping it all works out. For a one-off collaboration that's fine. But I regularly find directories packed with stale guest accounts that nobody remembers inviting. The pile keeps growing, at some point you can't realistically audit who has access to what, and cleaning it up by hand is tedious and easy to get wrong. Access packages for guests in Microsoft Entra ID entitlement management give you a far more structured approach that also scales, which matters now that external collaboration is normal rather than unusual.

Access packages for guests are replacing ad-hoc invitations

I've seen a clear shift in recent projects. Organizations are moving away from one-off guest invitations and towards entitlement management. The main advantage is that an access package does much more than add someone to a Teams group. You put everything an external partner needs (Teams, Microsoft 365 groups, SharePoint sites, even enterprise apps) into one package that sits in a catalog. Guests get a simple way to request access, and every assignment is tracked and governed. Compare that with the old model, where access was handed out piece by piece and almost never taken away again. With access packages, lifecycle management is part of the design from the start instead of something you deal with later.

Catalogs and policies form the building blocks of entitlement management

You start in the Microsoft Entra admin center under Identity governance → Entitlement management. The first step is a catalog, which is simply a logical grouping of related resources. Inside a catalog you create access packages. Each one bundles the resources (groups, Teams, SharePoint sites, applications) a guest or internal user needs for a particular role or project.

Most of the actual control sits in the policy attached to each access package. This is where you decide who may request access: specific connected organizations (cross-tenant access) or any external user, including people who aren't in your directory yet. You also set up approval flows, define how long access lasts and choose whether periodic access reviews should run. I use this simple diagram in workshops to show how onboarding and offboarding stay under control:

flowchart TD
  Applicant["External user requests access"] --> Policy["Policy checks origin and requirements"]
  Policy --> Approval["Approver approves or denies"]
  Approval --> Assignment["Resources assigned to user"]
  Assignment --> Expiry["Access expires or review required"]
  Expiry --> Removal["Access removed (guest auto-deleted)"]

Figure: The usual lifecycle of an access package for external users in entitlement management.

With this setup, onboarding external users is structured and auditable, and you can defend every decision. Lost invitations, forgotten permissions and uncontrolled guest sprawl stop being a problem.

Lifecycle settings remove guest accounts automatically

This is one of my favourite features. If you turn on "Remove guest users when they lose their last access package" in the entitlement management settings, guest accounts are deleted from your directory automatically once their final assignment is gone. That fixes the old problem of abandoned guest accounts hanging around for years after a project has ended. You enable it in Entra admin center → Identity governance → Entitlement management → Settings. From then on, a timer starts as soon as a user's last access package assignment is removed, and when the grace period runs out, the guest account is purged. In my experience it works reliably and cuts ongoing cleanup work considerably. If you want more ideas for keeping your guest directory tidy, have a look at my post on cleaning up guest accounts with access reviews.

Practical tip: Sit down with business owners early and agree which guests need access to which resources. Build catalogs and packages per project type and keep them as granular as you can. Onboarding gets easier and you keep a better overview.

The policy controls approval, expiration and reviews

Every access package policy defines:

  • Who can request access (internal, external, from particular organizations)
  • Whether approval is required, and who approves
  • How long access is granted, and whether it can be extended automatically
  • Whether access reviews run, and when
  • What happens on expiry: immediate removal, a grace period, notifications

Because expiry is built in and access reviews run periodically, permissions don't stay around indefinitely. That lowers risk and also helps with licensing, since guests lose access and are removed completely rather than lingering in old Teams or groups. I go into access reviews for guests in more detail in a separate guide on cleaning up guest accounts with access reviews in Entra ID.

Entitlement management requires Entra ID P2 or ID Governance

Entitlement management, and with it access packages for guests, needs Microsoft Entra ID Governance or at least Entra ID P2. Every internal or external user who requests or is assigned an access package has to be covered. For guests, though, you only need 1 P2 license per five unique active guests per month (see the docs). Without the license you don't get automated removal or policy-based assignment.

You handle everything in the Entra admin center under Identity governance → Entitlement management, including catalogs, packages and lifecycle settings. If you collaborate with other tenants, check your cross-tenant access settings as well, so you can control which organizations may request access and on what terms.

I recommend access packages for any serious external collaboration

Once you work with external users at any real scale, I don't know of a substitute for access packages in Entra ID entitlement management. Bundled resources, approval flows, an automated lifecycle and guest cleanup together solve problems I keep running into in one tenant after another. Yes, planning catalogs and policies takes some work up front. You get that back many times over in clarity, security and day-to-day efficiency. If you're still sending ad-hoc invitations, it's high time to switch to a structured approach. Your admins, business owners and security team will all notice the difference.