M365Clarity · Guests
Guest users are external accounts — typically from other organisations or personal email addresses — that have been invited into your Microsoft 365 tenant. They can be added to Teams channels, SharePoint sites, and Microsoft 365 Groups. Guest access is useful for collaboration, but unmanaged guest accounts accumulate over time and can give external parties access long after it's needed.
The Guests tab scans your tenant and shows you the total number of guest accounts, broken down by domain. It checks your guest access policies — whether guest invitations are restricted to specific domains or open to any external address, and whether guest users can invite other guests (a policy that can lead to rapid proliferation of external access).
Common finding: Many tenants accumulate hundreds of guest accounts from past projects, consultants, and partner collaborations. These accounts remain active indefinitely unless explicitly reviewed and removed.
The best way to manage guest users at scale is to configure access reviews in Microsoft Entra ID. Access reviews automatically ask group or site owners whether a guest user still needs access on a defined schedule — quarterly is common. M365Clarity checks whether access reviews are configured and surfaced as part of the Identity category.
In most organisations, the default guest invitation policy is too permissive. Microsoft recommends restricting guest invitations to admins only (or admins and specific user roles), limiting which external domains can be invited, and disabling guest-to-guest invitation rights. These settings are in Entra ID → External Identities → External collaboration settings.
M365Clarity scans your Microsoft 365 configuration and shows you exactly what's in your plan, what's configured, and what's sitting idle — in plain English.
Start free scan → View live demoRelated articles