Find and remove inactive guests

Find guests who no longer use their access, and disable their accounts or remove them from the workspaces they were invited to.

Before you begin

• Your Rencore role needs the permissions to create policies and automations, and to run built-in actions. See Rencore roles.
• Microsoft 365 is connected and scanned. Rencore Governance lists guests as users with the user type “Guest”.
• Disabling or deleting a user account changes Entra ID. Agree the rule with your identity team first.

Steps

See all guests

1. Go to Reports > Add Report.
2. In the “Report Template Library”, choose “External Users”. “Email Domains of External Users” groups them by domain, which helps you decide which partners are still active. See Create a Report from a Template.

Flag inactive and pending guests

1. Go to Policies > Policy Options ([…]) > Create Policy.
2. In the “Policy Template Library”, choose one of these templates:
   • Inactive external users: no sign-in for more than 6 months
   • External Users with pending acceptance and External users invited 3 month ago with pending acceptance
   • Teams with inactive external users
   • Groups with external owners and SharePoint site collection is owned by external users
3. On the “Logic” screen, change the inactivity period to your own rule, then save. See Create a Policy from a Template.

Disable or remove the guests

1. For one guest, open the user in the inventory and run Disable User Account, or Remove user from a Team and Remove user from a group to take away workspace access only. See Executing an Action.

2. To do this on every violation, use the automation template “Disable inactive external user accounts”. It disables external accounts that have not signed in for more than 6 months. See Create an Automation from a Template.

   It is good practice to run the automation manually on a few guests first, and to send the owners of their workspaces an email in the same automation.

3. A disabled account can be turned back on from its inventory page. Entra ID keeps deleted users for 30 days. In that time, Restore User Account brings one back.

Let owners remove guests

In a workspace review (see Create a Review) with the “Members” scope turned on, owners see every member of their workspace, guests included, and can remove the ones who no longer need access.

What you see

The policies list each inactive or pending guest. A disabled guest shows “Account enabled” as false in the inventory after the next scan.

Limits

• Rencore Governance does not invite guests, and it has no sponsor, inviter or expiry date for a guest.
• A guest is not a review object of its own. Owners review guests as members of their workspaces.