Guest access and external identities in Microsoft 365

Most organisations work with people outside the business: accountants, contractors, suppliers, clients. Microsoft 365 lets those people join Teams, open shared files or use apps as guests. Guests are a normal part of collaboration, but they are also accounts from outside the organisation with access to its data. This page explains how Microsoft 365 guest access works as Microsoft describes it: guest users, the settings that control them, and how access reviews fit in.

What a guest user is

Microsoft calls this B2B collaboration, part of Microsoft Entra External ID. Microsoft’s overview explains that B2B lets an organisation “share your company’s applications and services with guests, while maintaining control over your own corporate data.”

Key points from Microsoft’s description:

• Guests keep their own sign-in. Microsoft says guest users “sign in to your apps and services with their own work, school, or social identities.” The organisation doesn’t manage their password.
• Invitation and redemption. Microsoft describes “a simple invitation and redemption process” that lets partners use their own credentials. A guest is invited, accepts (redeems the invitation), and then appears in the directory as a user object.
• User type Guest. Microsoft states the user type is “typically set to ‘guest’” and their user principal name contains #EXT#.

For example, a fictional bookkeeper, Priya, is invited from ledger.example. She signs in with her own work account and shows up in the tenant’s user list as a guest.

The guide to how users and groups work in Microsoft Entra ID covers the directory more generally.

External collaboration settings

Microsoft Entra ID has external collaboration settings that decide who can invite guests and what guests can see. Microsoft’s B2B overview notes that “By default, all users in your organization, including B2B collaboration guest users, can invite external users to B2B collaboration.”

Guest invite settings. Microsoft’s documentation lists four options, from most inclusive to most restrictive:

1. Anyone in the organization can invite guest users including guests and non-admins (most inclusive)
2. Member users and users assigned to specific admin roles can invite guest users including guests with member permissions
3. Only users assigned to specific admin roles can invite guest users
4. No one in the organization can invite guest users including admins (most restrictive)

Microsoft describes a Guest Inviter role that lets chosen people invite guests “without assigning them a higher privilege administrator role”, even when the third option above is selected. The guide to admin roles and least privilege in Microsoft 365 explains how Microsoft describes choosing roles with fewer permissions.

Guest user access. Microsoft lists three levels for what guests can see in the directory:

• Guest users have the same access as members (most inclusive)
• Guest users have limited access to properties and memberships of directory objects (the default)
• Guest user access is restricted to properties and memberships of their own directory objects (most restrictive)

Collaboration restrictions. Microsoft describes allowing or denying invitations to specific domains.

Where to find these settings

Based on Microsoft’s instructions (checked October 2026). Menus can change; Microsoft’s external collaboration settings guide has the latest steps.

1. Sign in to the Microsoft Entra admin center with a role that can update external collaboration settings (Microsoft names Global Administrator or External Identity Provider Administrator, and says it recommends roles with the fewest permissions).
2. Go to Entra ID > External Identities > External collaboration settings.
3. Choose the options under Guest user access, Guest invite settings and Collaboration restrictions (Microsoft’s page covers each one separately, along with guest self-service sign-up and external user leave settings).

For context, ASD’s Blueprint for Secure Cloud publishes the settings its own build uses: the most restrictive guest user access option and the most restrictive invite option, with invitations allowed to any domain. The Blueprint says its settings “provide a baseline implementation for a system configured using the Blueprint”, and that implementation varies with each organisation’s operating context.

Guest access in Teams and SharePoint

Guest settings are layered across several admin centres.

Teams. Microsoft describes Teams guest access as a way to give people outside the organisation access to “teams, documents in channels, resources, chats, and applications.” Microsoft states that guest access in Teams “requires configuring other settings in Microsoft 365, including settings in Microsoft Entra ID, Microsoft 365 Groups, and SharePoint,” and that it is an organisation-wide setting, with access to individual teams controllable through sensitivity labels. Microsoft distinguishes this from external access, used to “find, call, chat, and set up meetings with people in other Microsoft 365 organizations” without adding them as guests, and from shared channels, which don’t need a guest account. The guide to Teams external access vs guest access compares the two in more detail. Based on Microsoft’s instructions (checked October 2026), the organisation-wide switch is in the Teams admin center under Users > Guest access, where Guest access is set to On or Off; Microsoft’s Teams guest access guide has the latest steps.

SharePoint and OneDrive. Microsoft’s SharePoint documentation lists four sharing levels for sites: Anyone, New and existing guests, Existing guests, and Only people in your organization. Microsoft notes that “Anyone links to files and folders can be freely forwarded,” and that the options available for a site depend on the organisation-level setting. The organisation-level setting is in the SharePoint admin center under Policies > Sharing, and Microsoft’s sharing settings page says each site can be set to the same level or a more restrictive one. Microsoft also states that Entra external collaboration settings “determine who can invite guests in your organization for site sharing (always) and file and folder sharing (if Azure B2B collaboration is enabled).”

Based on Microsoft’s instructions (checked October 2026), a SharePoint Administrator changes one site’s setting like this; Microsoft’s site sharing guide has the latest steps:

1. In the SharePoint admin center, go to Active sites.
2. Select the site.
3. On the Settings tab, select More sharing settings.
4. Choose an external sharing option, and optionally expand Advanced settings for external sharing for domain limits, guest access expiration and default link settings.
5. Select Save.

Microsoft notes that site owners can’t change these site sharing settings. The guide to SharePoint and OneDrive external sharing settings covers sharing levels, Anyone links and link defaults.

Access reviews

Guests tend to stay in a directory after the project ends. Microsoft’s access reviews documentation asks: “As people move teams or leave the company, how do you make sure that their old access is removed?” and states that “excessive access rights can lead to compromises.”

The simplest check is a list. Microsoft’s guest users page says that in the Microsoft 365 admin center, expanding Users and choosing Guest users shows the tenant’s guests, and that their access can be removed there.

Microsoft describes access reviews as a way to review group memberships, access to enterprise apps and role assignments regularly, “to make sure only the right people have continued access.” For guests specifically, Microsoft describes asking group owners to confirm they still need the guests in their groups. Microsoft lists reviewers such as specified reviewers, group owners, or the users themselves (self-review).

Licensing. Microsoft’s documentation states that access reviews require “Microsoft Entra ID Governance or Microsoft Entra Suite subscriptions” for the organisation’s users, and that “some capabilities, within this feature, may operate with a Microsoft Entra ID P2 subscription.” Microsoft’s governance licensing page adds that “Governance of guest users requires an Azure subscription be selected for guest billing”, and that some access review capabilities require guest billing. Microsoft 365 Business Premium includes Entra ID P1, which isn’t listed for access reviews. The Microsoft 365 licensing and security features reference shows which Entra ID edition Microsoft lists for each plan.

How guests are licensed

Microsoft’s Teams page states that “Guest access can be used with all Microsoft 365 Business Standard, Microsoft 365 Enterprise, and Microsoft 365 Education subscriptions” and that “No extra Microsoft 365 license is necessary.” It doesn’t mention Business Basic or Business Premium; Microsoft or a licensing provider can confirm those plans. Microsoft says the billing model for External ID applies to guests. Microsoft’s pricing page describes that model as based on monthly active users, “the count of unique external users who authenticate to your tenants within a calendar month”, and says “External ID requires an Azure subscription for billing.” Microsoft’s Entra licensing page states that External ID core features “are free for your first 50,000 monthly active users.”

Things that change

Several older Microsoft pages about guest sharing in Microsoft 365 are now marked as archived on Microsoft Learn, and Microsoft has moved guest features under the Microsoft Entra External ID name. This page reflects Microsoft’s documentation as checked on 21 October 2026.

Common questions

How does guest access work in Microsoft 365?

Guest access lets people outside the organisation join Teams, open shared files or use apps while signing in with their own account. Microsoft calls this B2B collaboration: a guest is invited, redeems the invitation and then appears in the directory as a user with the user type Guest. Microsoft says guests use “their own work, school, or social identities”, so the organisation doesn’t manage their password. What a guest user is has an example.

Who can invite guests in Microsoft 365 by default?

Microsoft’s B2B overview says that by default all users, including guest users, can invite external users. Microsoft’s external collaboration settings list four invite options, from anyone in the organisation through to no one, and describe a Guest Inviter role for chosen people. The settings are in the Microsoft Entra admin center under Entra ID > External Identities > External collaboration settings. Where to find these settings has the steps.

Can guests see our company directory?

Some of it, by default. Microsoft lists three guest user access levels, and the default is “Guest users have limited access to properties and memberships of directory objects”. The most restrictive level limits guests to their own directory objects, and the most inclusive gives them the same access as members. External collaboration settings lists the options, and notes the settings ASD’s Blueprint for Secure Cloud uses in its own build.

Do guest users need a Microsoft 365 licence?

Microsoft’s Teams page states that guest access can be used with Business Standard, Enterprise and Education subscriptions and that “No extra Microsoft 365 license is necessary”, though it doesn’t mention Business Basic or Business Premium. Microsoft says the External ID billing model, based on monthly active users, applies to guests, with core features free for the first 50,000. How guests are licensed covers the Azure subscription Microsoft says billing requires.

How do I see and remove guest users in Microsoft 365?

Microsoft’s guest users page says that in the Microsoft 365 admin center, expanding Users and choosing Guest users lists the tenant’s guests, and access can be removed there. For regular checks, Microsoft describes access reviews, such as asking group owners to confirm they still need their guests. Microsoft says access reviews require Entra ID Governance or Entra Suite. Access reviews has the licensing details.

What is the difference between guest access and external access in Teams?

Guest access adds someone to the tenant as a guest so they can use teams, channel documents, chats and apps. External access lets people “find, call, chat, and set up meetings with people in other Microsoft 365 organizations” without being added as guests. Microsoft also describes shared channels, which don’t need a guest account. The guide to Teams external access vs guest access compares them in detail.

Related guides

• SharePoint oversharing and Copilot covers why existing oversharing matters for Microsoft 365 Copilot.
• Admin roles and least privilege covers how Microsoft describes giving people the role with the fewest permissions.