Guest identities often bypass the lifecycle controls applied to employees, making them a preferred path for external attack propagation.

Preface

Entra B2B collaboration lets partners access shared Teams, SharePoint, and other resources. Without governance, guest accounts become long-lived, under-audited entry points. Employees are created by HR processes and removed when they leave. Guests are usually created by a sharing action, and nothing removes them when the project ends or when the person leaves the partner organization.

Problem

Compromised partner tenants can abuse authenticated guest access to host directories and channels. In unhardened tenants, guests may invite more guests or browse directory objects, enabling enumeration and spear-phishing.

How the attack works in practice

A guest authenticates in their home tenant, so the strength of that sign-in depends on someone else's security program. When a partner account is phished, the attacker inherits every guest relationship that account holds. From inside your tenant they can read the Teams channels and SharePoint sites shared with the guest, post messages that look like they come from a trusted supplier, and send files that carry the credibility of a known name.

With default guest permissions, the attacker can also look up users and group memberships, which helps identify finance staff or administrators for follow-on phishing. If members or guests can invite anyone, the attacker can bring additional external accounts into the tenant. And because stale guests are rarely monitored, a forgotten account from a project that ended two years ago is a quiet foothold.

Solution

Align with NIST SP 800-162 and CIS Microsoft 365 Foundations Benchmark:

  1. Restrict guest permissions: Block directory browse and group enumeration by setting guest user access to the most restrictive level, so guests can only see their own directory object.
  2. Enforce Access Reviews: Quarterly re-attestation with automatic disablement on failure. For guests, configure the review to block sign-in and then remove the account after a grace period. Access reviews require Entra ID Governance or P2 licensing.
  3. Block self-service guest invitations: Limit invites to delegated admin roles, such as Guest Inviter, or to an approved request path.

Design guidance

  • Use entitlement management for structured partners. Define connected organizations and access packages with expiration dates, sponsors and approval, so access is granted to a defined set of resources and ends automatically.
  • Apply Conditional Access to guests. Target the "Guest or external users" condition and require MFA. Use cross-tenant access settings to decide whether to trust the partner's MFA and device claims; trust only partners whose controls you have assessed.
  • Constrain who can collaborate. Use the collaboration allow or deny list of domains, or cross-tenant inbound settings, so invitations go only to known partner tenants.
  • Align SharePoint and Teams settings. Entra settings do not govern anonymous "Anyone" links. Restrict external sharing in SharePoint and OneDrive to existing or authenticated guests, and review Teams guest access settings.
  • Assign a sponsor to every guest. An internal owner is the person who answers the access review question.

Implementation steps

  1. Export all guests with creation date, invitation state and last sign-in, using the script below.
  2. Disable guests that never redeemed their invitation or have not signed in for 90 days, after a notice to sponsors, and remove them after a further period.
  3. Set guest user access to restricted and limit invitations to admins and the Guest Inviter role.
  4. Create a Conditional Access policy requiring MFA for guests, in report-only mode first.
  5. Configure recurring access reviews for all guests and for Microsoft 365 groups and Teams that contain guests.
  6. Move recurring partner relationships into access packages with expiration.

PowerShell: Audit Guest Users

Connect-MgGraph -Scopes "User.Read.All"
Get-MgUser -Filter "userType eq 'Guest'" -All |
    Select-Object DisplayName, UserPrincipalName, Id | Format-Table

To find stale guests, request the sign-in activity and invitation state. Sign-in activity requires the AuditLog.Read.All scope and Entra ID P1:

Connect-MgGraph -Scopes "User.Read.All", "AuditLog.Read.All"
Get-MgUser -Filter "userType eq 'Guest'" -All `
    -Property DisplayName, UserPrincipalName, CreatedDateTime, ExternalUserState, SignInActivity |
    Select-Object DisplayName, UserPrincipalName, CreatedDateTime, ExternalUserState,
        @{n = "LastSignIn"; e = { $_.SignInActivity.LastSignInDateTime }} |
    Sort-Object LastSignIn | Format-Table

To restrict guest permissions and invitations through the authorization policy:

Connect-MgGraph -Scopes "Policy.ReadWrite.Authorization"
# 2af84b1e-... is the "restricted guest user" role template
Update-MgPolicyAuthorizationPolicy `
    -GuestUserRoleId "2af84b1e-32c8-42b7-82bc-daa82404023b" `
    -AllowInvitesFrom "adminsAndGuestInviters"

Monitoring and detection

Track who invites guests and what guests do once inside. In Microsoft Sentinel:

AuditLogs
| where TimeGenerated > ago(30d)
| where OperationName in ("Invite external user", "Redeem external user invite")
| extend Inviter = tostring(InitiatedBy.user.userPrincipalName)
| extend Guest = tostring(TargetResources[0].userPrincipalName)
| summarize Invites = count(), Guests = make_set(Guest, 50) by OperationName, Inviter
| order by Invites desc

Spikes from one inviter, or invitations initiated by a guest, deserve investigation. For guest sign-ins, filter SigninLogs on UserType == "Guest" and compare HomeTenantId with your own tenant ID to see which partner tenants are most active, and alert on guest sign-ins with elevated risk or from tenants outside your partner list. In Teams and SharePoint, watch for bulk file downloads by guest accounts in the unified audit log.

Common mistakes

  • Running access reviews where reviewers are the guests themselves or nobody responds, with "no action" as the default outcome.
  • Trusting every partner's MFA claims through a default cross-tenant setting.
  • Restricting Entra guest settings while SharePoint still allows anonymous links.
  • Leaving unredeemed invitations in place indefinitely.
  • Granting guests the member user role to fix an access problem.

Where to start

Export your guests and look at last sign-in dates; the stale accounts are the fastest risk to remove. Then restrict guest permissions and invitations, require MFA for guests with Conditional Access, and schedule the first quarterly access review. Move long-term partners into access packages so expiration is the default rather than an afterthought.