Guest access hygiene: review the relationship, not only the account
A guest account is the technical trace of a business relationship. Removing old guests can be useful, but a date field alone cannot tell you whether a supplier engagement, project, legal matter, or shared workspace is still active.
Start with the resource
The useful question is not “when did this guest last sign in?” It is “what does this person still have access to, who sponsored it, and when should that access end?” A guest can be inactive and still be the only external owner of a shared artefact. A recently active guest can still have access that is no longer justified.
Build a review record with invitation state, creation date, recent sign-in where available, group and application membership, directory roles, licence assignment, sponsor, and the resources behind those assignments. Microsoft recommends access reviews for guest access, particularly when collaboration is ongoing rather than exceptional.
Use three outcomes
| Outcome | When it fits |
|---|---|
| Retain | Sponsor confirms a current purpose and least-privilege access |
| Review | No sponsor, ambiguous resource access, pending invitation, or privileged assignment |
| Remove | Access and business relationship have ended, with recovery expectations agreed |
Never batch-delete every pending invitation older than a chosen threshold. First inspect whether the invitation is linked to a group, an application, or a collaboration site. Remove access before removing the identity when a future relationship is plausible.
Control the default exposure
Lifecycle is only half the design. External collaboration settings, cross-tenant access, group ownership, and SharePoint or Teams sharing settings decide what a guest can discover and reach. Microsoft documents a more restricted guest setting that prevents guests from seeing directory information and group membership beyond their own context. Review it in guest access permissions.
Make the review defensible
Record the sponsor decision, the review date, the resource scope, and the action taken. Use soft deletion or access removal with a recovery period where your process allows it. For repeatable partner access, access packages and recurring access reviews are stronger than quarterly spreadsheet archaeology.
The guest hygiene export is read-only. Use it to create a review queue, not a deletion queue.