Govern guests and external users
AI summary
Identify and control guest access across your Microsoft 365 Teams and SharePoint environments. Policies flag inactive guests, pending invitations, and external members or owners, while automation can disable inactive external accounts. Workspace owners use reviews to remove unwanted guests from their workspaces.
Keep guest access to the people who still need it. Policies flag inactive guests, invitations never accepted and workspaces with external members or owners, and an automation template disables inactive external accounts.
Applies to
Who it is for: security and compliance teams, and the workspace ownersWorkspace ownerA workspace owner is an owner of a Microsoft 365 workspace, such as a Team, a SharePoint site or a group.Read more who invited the guests.
Steps
- List your guests. Create a segment on the Users inventory for all users where IsExternal is true, or create a report from a template.
- Flag the guests who should go. Turn on the guest policies below: create a policy from a template.
- Act on them. Create an automation from a template, for example “Disable inactive external userExternal userAn external user is an account whose home tenant belongs to another organization, invited into your tenant to work with you.Read more accounts”.
- Ask owners to confirm their guests. Create a review of the TeamsMicrosoft TeamsMicrosoft Teams is the Microsoft 365 app for chat, meetings and team collaboration.Read more, groups and sites that have guests. Owners remove guests as members in the review.
Step by step: Find and Remove Inactive Guests.
Policy templates
- Microsoft 365 policies: External users, Inactive external users, External Users with pending acceptance, External users invited 3 month ago with pending acceptance, Groups with external users, Groups with external owners.
- Teams policies: Teams with external users, Teams with inactive external users, Shared Channels with external access.
- SharePoint policies: SharePoint file is shared with inactive external user, SharePoint site collection is owned by external users.
Automation templatesAutomationAn automation is a workflow Rencore Governance runs on inventory objects when a trigger fires.Read more: Microsoft 365 (Disable inactive external user accounts) and Teams (Mark teams with external users).
Limits
- A guest is not a review object of its own. Guests are reviewed as members of a workspace.
- Rencore Governance does not invite guests, and it has no sponsor and no expiry date for a guest.
Frequently asked questions
How do I list all guests in Rencore Governance?
Create a segment on the Users inventory for all users where IsExternal is true. You can also create a report from a template.
Can Rencore Governance invite guests or set an expiry date for them?
No. Rencore Governance does not invite guests, and it has no sponsor and no expiry date for a guest.
How can I have workspace owners confirm which guests should stay?
Create a review of the Teams, groups and sites that have guests. Owners remove guests as members in the review, because guests are reviewed as members of a workspace and not as review objects of their own.
Was this page helpful?
Thanks for the feedback.
Thanks. What was wrong?
Next steps
- Find and fix oversharing
- Recertify access with reviews
- Govern Power Platform and Power BI (guests in Power BIPower BIPower BI is the Microsoft service for reports and dashboards over business data.Read more)