External users
AI summary
The External users policy detects guest accounts in your Microsoft 365 environment that may accumulate over time and pose security risks. You should regularly review guest accounts to validate they retain necessary access and remove inactive or unnecessary external users. Automated periodic removals can help maintain a secure collaboration environment with only actively required external access.
What it detects
Shows external usersExternal userAn external user is an account whose home tenant belongs to another organization, invited into your tenant to work with you.Read more (users with user type 'Guest').
Why it matters
Guest accounts accumulate over time and may retain access to sensitive resources long after collaboration ends, creating security risks and compliance challenges. Conduct regular reviews through Rencore Governance to validate each guest account's continued necessity, remove inactive or unnecessary external users, or implement automated periodic removals to maintain a secure collaboration environment with only actively required external access.
The rule
Every User where Is External is true
In Rencore Governance
Details
| Applies to | User |
|---|---|
| Connector | Microsoft 365 |
| Severity | Information |
| Category | External Access |
| Recommended | Yes |
| Recommended automation | None |
| License type | Standard |
Related policies
Other policies that check User objects:
- Copilot adoption opportunity - E3/E5 users (Medium)
- Copilot license assigned to disabled account (High)
- Inactive Copilot users - 30 days (Medium)
- Excessive draft agent creation pattern (Medium)
- External users with pending acceptance (Low)
- Users with Power Platform Premium license (Information)
- Users with E3 license not using Outlook in last 12 month (Low)
- Users with passwords not changed in last 6 months (Medium)
- Disabled user accounts (Medium)
- Admin accounts with an Office 365 E3 license assigned (Medium)
- Administrators without MFA (High)
- External users invited 3 month ago with pending acceptance (Low)
- Disabled user accounts with assigned licenses (High)
- Global administrators without MFA (High)
- Guest users with a Dynamics license assigned (Medium)
- Inactive external users (Medium)
- Inactive internal users (Medium)
- Over-licensed user accounts (High)
- Users who are creating Microsoft Loop Teams components (Medium)
Frequently asked questions
What does the external users policy detect?
The External users policy shows external users (users with user type 'Guest').
Which objects does the external users policy check?
The External users policy checks User objects from the Microsoft 365 inventory and reports each one that matches its rule as a violation.
How severe is a violation of the external users policy?
Violations of the External users policy have Information severity. The policy is in the External Access category.
Which module includes the external users policy?
The External users policy comes with the Microsoft 365 connector in the Digital Workplace module of Rencore Governance, which every Plan includes.
Was this page helpful?
Thanks for the feedback.
Thanks. What was wrong?