Microsoft 365 guest access allows people outside your organisation, such as contractors, accountants and clients, to work inside Microsoft Teams, SharePoint and other shared resources. For a London SME, this is often necessary for day-to-day trading. Left unmanaged, however, guest accounts can remain active long after a project ends, and sharing settings can expose internal files to recipients nobody has verified. This article explains how to configure guest access so that external collaboration continues without losing control of company data.
Table of Contents
- Quick Takeaways
- Why Guest Access Creates Risk in London SMEs
- Configuring Guest Access in Microsoft Entra ID
- Controlling SharePoint and Teams External Sharing
- Comparing Guest Access Approaches
- Reviewing, Removing and Monitoring Guests
- Frequently Asked Questions
- References
Quick Takeaways
| Key Insight | Explanation |
|---|---|
| Assign an internal sponsor to every guest | Each external account should have one employee who approves the access, confirms its purpose and requests its removal. |
| Set external sharing to the lowest level the work requires | For most client and supplier projects, “Existing guests only” in SharePoint is the appropriate default. |
| Set an end date for every engagement | Guest access tied to a project closure date is removed as part of the handover, not weeks later when someone remembers. |
| Review guest accounts every quarter | A quarterly review of sponsors, last sign-in dates and group memberships removes stale accounts before they become an exposure. |
| Check anonymous links monthly | Anonymous links can be forwarded beyond the intended recipient, so each one should have an expiry date and a named owner. |
| Confirm which controls your plan includes | Microsoft’s security guidance for businesses lists Conditional Access in Business Premium, so the plan determines which sign-in controls are available. |
Why Guest Access Creates Risk in London SMEs
Most London SMEs adopt guest access informally. A project manager invites a supplier to a Teams channel, a finance director shares a folder with an external accountant, and the arrangement continues for years without review. The business benefit is real, but the access model was rarely designed deliberately.
The main exposures are predictable. Guest accounts persist after projects close, invitations are sent to personal email addresses, and files shared through anonymous links can be forwarded to people the owner never intended to reach. Microsoft’s security guidance for businesses with up to 300 users treats identities, devices, collaboration content and data as separate areas of protection, so guest access sits across several of them at once.
Configuring Guest Access in Microsoft Entra ID
Guest accounts in Microsoft 365 are held in Microsoft Entra ID, the directory that also manages employee accounts. Administrators control who can invite guests, what guests can see in the directory, and which external domains are permitted. Setting these options before the first invitation is far simpler than removing access afterwards.
Limiting who can invite guests
Restrict guest invitations to named administrators or a small group of trusted users. Where project leads need to invite external contacts, document the process so that every guest has an internal sponsor. The most effective control is a short written rule: no guest is added without a sponsor and an end date.
Restricting what guests can see
Guests should not be able to browse the full company directory or enumerate group memberships. Avoid adding guests to broad groups such as “All Staff”. Where a guest needs to join a project, add them to a group named for that project, which can be deleted when the work ends.
Pro tip: Create a dedicated Microsoft 365 group for each external engagement. Deleting the group at project close removes access to its associated Team and site in one step, which is easier to audit than removing individual permissions.
Guest identities are authenticated by their home organisation or by a one-time passcode, so your own controls apply only where you configure them. Microsoft’s guidance states that security defaults, which enforce multi-factor authentication, are on by default for Microsoft 365 for business. Conditional Access policies with stricter requirements are included in Business Premium, and for guests who access sensitive client material, a policy requiring multi-factor authentication is worth configuring.
Controlling SharePoint and Teams External Sharing
SharePoint and OneDrive sharing is governed by tenant-level settings and then by site-level settings, and the stricter setting applies. For most London SMEs, the aim is to allow named external collaboration while blocking anonymous access to internal files.
SharePoint sharing levels
SharePoint offers several sharing levels, from anonymous links that anyone can open to access limited to people already present in your directory. “Existing guests only” suits most client and supplier work, because the recipient must already be registered as a guest. Anonymous links should be reserved for documents intended for public circulation, and every externally shared link should carry an expiry date.
Teams guest access in practice
Teams guest access allows external users to join teams and channels where an owner has added them. A guest added to a team can see every standard channel in that team, not only the one required for the project. Owners should therefore create a separate team for each engagement and review membership regularly. Microsoft’s Teams plan comparison page sets out which features each business plan includes, and it is worth checking before relying on a specific control.
Pro tip: A site-level invitation can expose more content than the project requires. Before inviting a guest, review the site’s document libraries and move any internal material to a separate site.
Comparing Guest Access Approaches
Three approaches cover most SME scenarios. They differ in how easily the recipient can gain access and how much traceability the business retains. The table compares them for SharePoint and Teams work.
| Approach | Suitable use | Control and risk |
|---|---|---|
| Anyone with the link | Public documents or one-off file transfers that require no sign-in | Lowest control. Links can be forwarded and cannot be tied to a named person, so expiry dates are essential. |
| New and existing guests | Projects where new external contacts must sign in | Moderate control. Recipients authenticate, so access is traceable, but sponsors must review new guests promptly. |
| Existing guests only | Ongoing client, supplier or contractor work | Highest control of the three. Access is limited to people already invited and approved, which suits most London SME engagements. |
For most SMEs, “Existing guests only” should be the default setting. The other options should be used by exception and recorded in the project documentation, so that the reason for each open setting remains clear.
Reviewing, Removing and Monitoring Guests
Guest access becomes a risk mainly through inactivity. Accounts created for a single engagement often remain active for years, and the internal sponsor may have left the business. A scheduled review turns guest management from a one-off setup task into an ongoing control.
Quarterly guest access reviews
Each quarter, list every guest, the sponsoring employee, the last sign-in date and the groups or sites the guest can reach. Remove any account without a current sponsor, and any account inactive for an agreed period. Microsoft Entra offers access review functionality for this purpose, although its availability depends on the Entra licensing your business holds.
Offboarding guests at project close
Add guest removal to the project closure checklist, alongside the handover of files and final invoices. Remove the guest from groups and teams, confirm that no sharing links remain active, and record the sponsor’s sign-off. A common mistake is to remove a guest from a team but leave a shared link in a SharePoint library, which keeps the content accessible.
Guest access is safest when every external identity has an internal owner and a defined end date.
Many London SMEs find that quarterly reviews are the first task to lapse when internal staff are busy. A managed IT support service for London businesses can schedule these reviews, handle guest changes through the helpdesk and monitor sharing settings, so accountability stays clear without adding administrative work to the internal team.
Frequently Asked Questions
How can a contractor join a project without seeing other company files?
Create a dedicated team for the engagement, add the contractor as a guest, and store the project files in that team’s SharePoint site. Avoid adding the contractor to existing company teams, because they would see every standard channel in those teams.
Should guests be required to use multi-factor authentication?
Guests authenticate through their own organisation or a one-time passcode, so the requirement is set by your Conditional Access policies. For access to client or financial material, a policy requiring multi-factor authentication for guest sign-in is a reasonable control, provided your plan includes Conditional Access.
How often should guest accounts be reviewed?
Quarterly reviews suit most SMEs. Businesses that share sensitive client data should review guest accounts monthly and check sharing links at the same time.
What should be done if a guest was added in error?
Remove the guest from all groups, teams and sites, and disable the account. Then review the audit log for the period the account was active, so that you can establish which content was viewed or downloaded and whether any notification duties apply.
Is blocking all external sharing a practical option?
For most businesses that work with clients or suppliers, blocking all external sharing is not practical. A more workable approach is to set “Existing guests only” as the default, allow anonymous links only by exception, and review both on a fixed schedule.
Please share your experience of managing external collaboration in your organisation, including any challenges you have encountered with guest access.