Clean up guest accounts with access reviews

Every Teams invite and shared document can leave a guest account behind. A few years on, most tenants have hundreds or thousands of guests, many with access nobody remembers granting.

What an access review does

An access review asks reviewers to confirm whether each member of a group, team or app still needs access. You choose who reviews (group owners, managers, or the guests themselves), how often, and what happens to people nobody approves.

A good guest review

• Scope: all Microsoft 365 groups and Teams with guest members, guests only.
• Reviewers: group owners, since they know who they work with. Use a fallback reviewer for groups without owners.
• Recurrence: quarterly, with a two-week window.
• If reviewers don't respond: remove access. Without this, a review that nobody completes changes nothing.
• Auto-apply results, so removals happen without anyone clicking a button.

Go one step further

Removing a guest from a group doesn't delete their account. A separate review of all guest users in the tenant can block sign-in for guests who are denied, then delete them after a set period, such as 30 days. That stops dormant guest accounts building up.

Licensing

Access reviews need Entra ID Governance licensing (or P2 for some scenarios). Reviewing guests uses a separate Entra ID Governance guest billing meter, which needs a linked Azure subscription.

Making reviews easy for owners

• Use recommendations. Reviews can show a recommendation based on recent sign-in activity, which helps owners decide quickly.
• Keep the window realistic. Two weeks with reminders works better than a few days.
• Explain the email. Owners often ignore review emails they don't recognise. A short Teams post first makes a big difference.

Measuring the effect

Track the number of guests and the percentage that are stale (no sign-in for 90 days) before and after the first few reviews. The tenant health check reports both.