Every guest in Microsoft 365 needs a sponsor and an end date
A guest account is the easiest thing in Microsoft 365 to create and the last thing anyone thinks to remove. The audit wraps up, the vendor finishes the rollout, the agency's contract ends. The guest stays, holding whatever access it was given on the day somebody needed a file moving quickly.
Our rule for guests has two parts. Every guest has a named sponsor inside the organization, and every guest's access runs on a clock that ends unless someone renews it. Microsoft now supplies the parts for both. The work is choosing your clock and filling the sponsor field.
Where guests come from
When SharePoint and OneDrive use Microsoft Entra B2B integration, sharing a file, folder or site with someone outside creates a guest account in your directory, and Entra's external collaboration settings decide who may invite. External sharing is on by default for the whole SharePoint and OneDrive environment. So the guest population grows from everyday work, mostly through people clicking Share, not through an admin issuing invitations.
The sponsor field is the ownership record
Entra's Sponsors field names the person or group responsible for a guest's lifecycle. Whoever invites a guest becomes the sponsor automatically unless they name someone else, and a guest can have up to five. Being a sponsor grants no admin powers. It's an accountability record, which is exactly what most tenants lack.
Here's the gap. Learn lists a known issue: when an external user is invited through SharePoint, for example by sharing a file with someone not yet in the directory, no sponsor is added. So the most casually created guests have nobody attached. Learn points to a PowerShell script in the Microsoft Identity Tools module, `Update-MsIdInvitedUserSponsorsFromInvitedBy`, that sets each guest's sponsor to whoever originally invited them, using the InvitedBy property. Run it before any review that emails sponsors.
Sponsors leave too. A tenant admin can reassign the field during offboarding, so it belongs on the leaver checklist. Friday's post covers the rest of that list.
Four clocks, and what each one misses
SharePoint guest expiration. Set in the SharePoint admin center under Policies > Sharing. Site admins see a banner 2 to 3 weeks before a guest expires, get a weekly email listing upcoming expirations, and can extend or remove access. It applies only to guests given access after the policy was switched on. It works per site, so a guest can lose a site and keep a team or security group elsewhere. Links never deactivate; the guest's access does. And it doesn't touch the Entra account.
Access reviews of guests in groups. In Entra ID Governance, an access review can ask group owners, or the guests themselves, to confirm continued membership in Microsoft 365 groups and teams. For reviews of selected teams and groups, denied guests can be blocked from signing in for 30 days and then removed from the tenant. That option isn't available when the review covers all Microsoft 365 groups with guests.
Inactive guest reviews. Learn's pattern scopes a review to a dynamic group of guests, sets a days-inactive threshold of up to 730, and removes access when reviewers don't respond. Guests younger than the threshold are skipped, so nobody is removed before signing in once. Deleted guests can be restored for 30 days.
Guest lifecycle policies, in preview. Lifecycle Workflows now offers tenant-wide guest policies: sponsor attestation (90 days by default, configurable from 30 to 365), an activity requirement (90 days by default, 30 to 730), a minimum sponsor count, and deletion of invitations still pending acceptance. Policies are evaluated once a day, and a tenant can have up to 20. Microsoft labels the feature preview and not recommended for production. It also needs Entra ID Governance licensing and a connected Azure subscription for a guest billing meter. Pilot it on one guest population, not all of them.
None of these is built to clean up direct item permissions or sharing links. Monday's site access reviews are where those get caught.
Decisions to write down
What silence means. We'd set non-response to remove access for guests. Learn's pattern blocks sign-in for 30 days before deletion, and a deleted guest can be restored for 30 more, so that's a safe default.
Which sites never take guests. Learn's advice is to keep confidential content in sites with external sharing off. The records owner names those sites.
How to pause sharing. Turning external sharing off for the whole organization and back on restores guest access. Turn it off site by site first.
Who answers. Sponsors attest. Site owners extend or remove expirations. The identity team runs reviews and policies. The business owner of each vendor or partner relationship is the sponsor of record.
On the roadmap, Microsoft Teams will let users report suspicious guest invitations to IT (roadmap ID 571297, in development, general availability stated as November CY2026).
A guest with a sponsor and a clock is a collaboration. Take away the sponsor and the clock and you're left with an open door, and nobody can say why it's open.
