Left unchecked, guest access in Microsoft 365 turns into a tangled mess fast. In many tenants I review, nobody gave guest invitations much thought. Anyone can invite anyone, and there's little visibility into who is collaborating with whom. The push to restrict guest invitations usually follows a security incident or an audit, but boundaries work far better when you set them before something goes wrong. Below I cover how to get this right in Entra ID and the pitfalls I run into most often in the field.

Entra ID sets the baseline for who may invite guests and from which domains

The foundation for controlling guest invitations sits in the Entra admin center under Entra ID → External Identities → External collaboration settings. This is where you decide who can send guest invitations: any user, admins and guests, admins only, or users assigned the special Guest Inviter role. I never recommend leaving this wide open. In real deployments, limiting it to admins and a few carefully chosen Guest Inviters stays manageable and keeps surprises to a minimum.

For tighter control, use the collaboration restrictions allow/deny list. Under domain restrictions you define which external domains are allowed or blocked for guest invitations (Microsoft's documentation). Most organizations do well to start with an allow list, because expanding it later is much easier than cleaning up a guest mess. Keep in mind that these lists apply tenant-wide, no matter where the invitation is triggered. That makes them a reliable baseline.

graph TD
  A["User"] --> B["Send invitation"]
  B --> C["Role & domain check in Entra ID"]
  C -->|"Allowed"| D["Guest account created"]
  C -->|"Not allowed"| E["Invitation rejected"]

Figure: Whether an invitation goes through depends on the role and domain checks.

The Guest Inviter role delegates invitations without creating chaos

The Guest Inviter role was built for exactly this purpose. Assign it to the people or small groups who actually need to bring in external collaborators. They get no broader admin rights, only the ability to invite guests. In my experience it works best when it goes to business owners or team leads, not when it's handed out en masse. You can review and audit Guest Inviter assignments in Entra admin center → Roles and administrators. Don't fall into the classic trap of assigning it to a broad group like "All Employees". That just recreates the original problem.

Tip: In many audits I find the Guest Inviter role assigned far too widely. Review these assignments on a regular schedule and tighten them wherever you can.

SharePoint and Teams sharing settings have to match the Entra ID controls

It's tempting to assume the Entra settings cover everything, but SharePoint and Teams have their own sharing controls. The SharePoint/OneDrive sharing settings (SharePoint admin center → Sharing) can be stricter or looser than your Entra ID baseline. When the policies don't match, users get confused and invites break (my baseline for these settings). Teams inherits the SharePoint/OneDrive settings for file and folder sharing, but invitations to Teams itself always pass through the Entra ID checks first. So when a Teams guest invite fails, the cause is usually a role or domain restriction in Entra ID. File sharing, on the other hand, can also run into additional SharePoint/OneDrive limits.

Then there are the cross-tenant access settings. Enabling B2B Direct Connect or shared Teams channels with other organizations opens the door to new domains and permissions (documentation). The feature is useful, but review it carefully, because it can override your standard restriction model.

Email one-time passcodes and legacy guests force a choice between convenience and control

Guests without a Microsoft account can sign in with an email one-time passcode. That's convenient, but it carries risk, since these guests are harder to tie to a trusted home tenant identity. In regulated environments I recommend disabling email OTP authentication in the external collaboration settings and sticking to known, managed accounts. If you have to allow email OTP, at least combine it with a domain allow list so you control who gets in.

The other problem I keep seeing is a growing pile of outdated or never-accepted guest accounts. Periodic access reviews (these require Entra ID Governance) are the only reliable way I've found to keep the guest list in shape (my cleanup process).

My practical baseline restricts guest invitations and keeps collaboration sane

This is the basic setup that works in most environments I've seen:

  • Guest invitations allowed only for admins and designated Guest Inviters
  • Domain allow list in place and reviewed regularly
  • Email OTP guest authentication disabled unless there's no way around it
  • SharePoint/Teams sharing policies aligned with the Entra ID guest controls
  • Quarterly access reviews for guest users

With this in place, collaboration stays flexible and the risks stay manageable. For stricter scenarios, add cross-tenant access settings and Conditional Access on top, either to require MFA for external users or to limit resource access further.

A typical access review configuration (Entra ID Governance licence, Global or Identity Governance Admin role) might look something like this:

{
  "reviewType": "GuestAccess",
  "frequency": "quarterly",
  "reviewers": ["External collaboration owners"],
  "autoApplyDecisionsEnabled": true
}

Whatever your organization looks like, the time you spend restricting guest invitations with Entra ID, SharePoint and Teams pays off. Check regularly whether the controls actually do what you intended, and don't wait for an audit to tell you.