External collaboration in Teams and SharePoint creates real security risks if guest access isn't properly governed. Here's how to configure Entra External ID and guest access policies correctly.
Key takeaways
- 1Who can invite guests — all users, member users only, or admins only
- 2Which external domains are allowed or blocked
- 3What guests can see in the Entra directory
- 4Cross-tenant access settings for specific partner organisations
Modern businesses collaborate extensively with external parties — contractors, clients, accountants, lawyers, suppliers. Microsoft 365 makes this easy via Teams guest access and SharePoint external sharing. Too easy, in fact: default settings often allow more external access than businesses realise.
What Entra External ID governs
Entra External ID (formerly Azure AD B2B) manages how external users are invited to your tenant and what they can access:
- Who can invite guests — all users, member users only, or admins only
- Which external domains are allowed or blocked
- What guests can see in the Entra directory
- Cross-tenant access settings for specific partner organisations
SharePoint external sharing settings
SharePoint has its own external sharing controls, separate from but aligned with Entra settings:
- Anyone links — no authentication required (highest risk, suitable for very limited use cases)
- New and existing guests — external users must authenticate
- Existing guests only — only users already in your directory can access
- Only people in your organisation — no external access
Optimyze recommends "New and existing guests" as the maximum for most clients, with Anyone links disabled entirely.
Guest access reviews
Over time, guest accounts accumulate — contractors who've left, clients from completed projects, partners from old relationships. Entra ID access reviews let you automatically review and remove stale guest accounts on a schedule. Optimyze configures quarterly access reviews for guest accounts for all managed clients, removing inactive guests automatically.
