Guest Access¶
Guests are people from outside the organisation who are given an account in the tenant: partners, contractors and auditors. They are the most common source of stale access, because nobody inside the organisation notices when they no longer need it. This page sets how guests are invited, what they can see, and how they leave.
Status: partly in place
Conditional Access policy CA005 requires MFA for guests (currently report-only). Invite settings, cross-tenant access settings and guest reviews are not yet defined in code.
Standard¶
| Setting | Standard | Where |
|---|---|---|
| Who can invite | Only users in specific admin roles (Guest Inviter or higher), not all members | Entra ID → External Identities → External collaboration settings |
| What guests can see in the directory | The most restrictive level: guests see only their own directory object | Same place, Guest user access restrictions |
| Allowed domains | Allow list of partner domains if the guests are known. Otherwise, a block list of consumer domains. | Collaboration restrictions |
| MFA | Required, through CA005. Trust a partner's MFA only if that partner tenant is known and trusted. | Conditional Access, and cross-tenant access settings |
| Access | Through access packages with an expiry, not direct group membership | Entitlement management |
| Sponsor | Every guest has a named internal sponsor who answers for them | The guest's sponsor attribute |
| Privileged roles | Guests never hold Tier 0 or Tier 1 roles | Role Tier Mapping |
Cross-tenant access settings¶
The default inbound and outbound settings apply to every external tenant. Keep the defaults strict. Add per-organisation settings only for known partners, where you can:
- trust their MFA and device compliance claims, to avoid prompting guests twice;
- limit which of their users and groups can be invited.
How guests leave¶
- Access package expiry removes access automatically at the end of the assignment.
- Quarterly access review of all guests, reviewed by the sponsor. Guests not confirmed are removed.
- Inactive guests: a guest who hasn't signed in for 90 days is disabled, and deleted 30 days later. Entra ID Governance lifecycle workflows or a scheduled script can do this.
Managing it as code¶
External collaboration and cross-tenant access settings can be managed through Microsoft Graph (policies/authorizationPolicy and policies/crossTenantAccessPolicy) with the msgraph provider. They fit best in the Conditional Access repository, where tenant-wide identity policy already lives.