Microsoft 365 reporting guest access
Every guest in your tenant, SharePoint-only ones included. Ranked by what they can reach.
In a typical tenant, hundreds of guests have not signed in for a year but still hold access, and a second class of guests - people who got in through a SharePoint link or site permission - never became directory objects at all. 1Security lists both kinds of guest, shows exactly which sites, files and groups each one can still open, and stages the removal behind a review window.
The problem
Guests are easy to invite, invisible to review, and never leave.
A supplier gets added to a Teams channel. An auditor gets a link to a folder. A contractor is invited into a project site. Each is one click for the person who did it and nobody's job afterwards. Most tenants we connect to hold hundreds to thousands of guests, and a large share of them last signed in over a year ago.
The quarterly review usually starts from a directory export: guest object, sponsor, last sign-in. Two things are hard to get from that alone. First, SharePoint can grant access to external people who never become directory objects - these SharePoint-only guests hold real permissions, and a review that starts from the directory has no row for them, which is exactly why they pile up. Second, an export tells you when a guest signed in, not what the guest can reach.
That second point is the one that matters. A guest who last signed in 14 months ago and still holds access to three project sites and a folder with contracts is the row worth acting on. 1Security ranks by exactly that, because it reads the actual permissions on every site, group and file.
In practice
The guest review, done from what they can reach.
Run it once as a cleanup or every quarter as a standing review - the list is live either way.
- 01
Count every kind of guest
Open Users and filter to external. Entra guests and SharePoint-only guests are broken out as separate types, each with a live count. The second number is usually the surprise: it is common to find dozens or hundreds of external identities that were never on any review list.
- 02
Sort by what each guest can still open
Every guest row shows sites, files and groups in reach, sensitive files among them, and the sharing links they created. Sort by files reachable descending and the top of the list is a single external credential that opens tens of thousands of documents.
- 03
Cut to the ones nobody uses
Add the filter for no activity in the last year. Access still standing, last real activity long gone. Combine with "can reach sensitive information" and you have the guest cleanup list in the order it should be worked - typically a few hundred rows, not the whole population.
- 04
Remove access with a safety net
Enable the suggested automation for idle guests and 1Security stages a proposal per guest behind a 72-hour review window. Site owners can be asked to confirm, so an active collaboration is never cut by mistake; rejecting a proposal snoozes it. Every removal lands in the Actions log.
What makes it work
Three parts of the platform behind the report.
Guest risk is an access question, so the report is built on the permission graph, not on the directory.
Access management
Every guest's effective reach resolved through groups, sharing links and site inheritance - the ranking column that turns a guest list into a work queue.
Explore the feature →Lifecycle management
Idle-guest indicators, offboarding flows and the automations that keep the guest population from growing back after the cleanup.
Explore the feature →SharePoint governance
The site-side view of the same story: which sites hold external users, and which have been abandoned for a year with guests still inside.
Explore the feature →
FAQ
Common questions.
How does this fit with Entra access reviews?
They complement each other. Entra access reviews certify the guests in your directory. 1Security adds the SharePoint-only guests, who are not directory objects, and ranks every guest by what it can really reach and when it was last active - so a review can start from the rows that matter, both classes included.
Can we remove guest access from 1Security?
Yes, under the separately approved write module. Removal resolves every source of access - direct grants, sharing links, group and site membership - shows what each source unlocks, and stages the change behind a review window with optional owner confirmation. Until you approve that module, the connection is read-only.
How current is "last activity"?
New activity shows up within minutes at any tenant size, and up to three years of history sit behind every guest row on standard licenses. "Last activity" means the guest actually opened, edited or downloaded something - not just a sign-in timestamp.
Do we need E5 or Entra P2 for this?
No. Guest reporting, reach and idle-guest detection run on standard Microsoft 365 licensing, with no agent to install.
Count your guests. All of them.
Connect read-only and see every guest with what they can reach the same day - SharePoint-only ones included.
Or keep reviewing only the guests that were easy to list.