Security
Your last contractor still has guest access — how Australian SMBs find leftover Microsoft 365 guests in 15 minutes
14 September 2026
Most Australian SMBs I talk to think offboarding finished when they disabled the contractor’s email. Then we open Users → Guest users and find the same person still sitting in the directory — #EXT# UPN, still in a Team, still able to open the SharePoint site they were invited to last year.
That’s not the same problem as unused licences. Guests usually don’t cost you a seat. They cost you leftover access. I help SMBs find that quietly, in plain English. Paths match Microsoft Learn as of writing. Not legal advice.
What a Microsoft 365 guest actually is
A guest is an Entra B2B external (UserType=Guest). They authenticate in their own tenant (or a personal Microsoft account), not yours. Removing them from one Team does not delete the guest object. The account can stay in your directory and keep hitting Teams and SharePoint collaboration surfaces they still belong to.
If you only look at paid seats, you will miss them. Last week’s unused-seats find is about money. This one is about people who can still open files after the job ended.
Why leftover contractors matter
- The project ended; nobody owned guest hygiene
- Someone left a Team and everyone assumed that was “deleted”
- A sponsor changed jobs; the guest kept every membership
- Pending invites piled up next to people who signed in once in 2023
You don’t need Identity Governance to see the list. You need 15 minutes and a rule for what “stale” means in your shop.
What you can see in 15 minutes
This is a find, not a delete run. Inventory, then triage.
| Minutes | Step | Do |
|---|---|---|
| 0–2 | Guest inventory | Microsoft 365 admin → Users → Guest users |
| 2–3 | Alt filter | Users → Active users → filter Guest users (same list, different door) |
| 3–6 | Entra clues | entra.microsoft.com → Entra ID → Users → filter Guest. Check invitation state, #EXT# UPN, Sponsors |
| 6–10 | Last sign-in | Edit columns → Last interactive sign-in time → filter to your window |
| 10–13 | Still wired? | Open the suspect → Teams & groups / Membership. Are they still in a Team or SharePoint group? |
| 13–15 | Optional activity | Reports → Usage → Teams. Active guests ≠ full inventory — use it as a clue, not the source of truth |
Tag each name as you go: Pending · Never signed in · Quiet · Still wired · Needs owner.
Active vs stale (you pick the window)
“Stale” is an org rule, not a Microsoft switch. Learn examples often sit at 90–180 days. Inactive-guest insights (if you have them) default to 90. Never-signed-in guests are judged from creation date, not last sign-in — they never had one.
Last interactive sign-in can lag about a day. Some Graph sign-in fields need Entra ID P1/P2. Don’t assume every SMB tenant has inactive-guest automation or Access Reviews. Those are optional scale, not required for this find.
Don’t confuse these with leftover guests
- Shared channels — people can collaborate via B2B direct connect without a guest object in your directory. Shared-channel users will not show up as guests. Do not treat the guest list as “everyone external.”
- Teams usage “active guests” — activity, not inventory. Quiet guests still exist.
- Unused licences — guests usually don’t consume a paid seat. Different problem, different screen.
- Pending invites — not leftover access yet. Clean separately if you want a tidy directory.
- Sponsored guests you still need — accountant, MSP, long-running partner. Quiet ≠ delete.
Safe clean-up (after the find)
- Confirm with the sponsor or Team owner
- Map Teams / Groups memberships
- Review sharing on the sites they could still reach
- Block sign-in
- Remove memberships
- Delete the guest (soft-delete, restore window about 30 days)
- Optional: Entra Identity Governance Access Reviews if you’ve outgrown a spreadsheet
Block before delete. Rushing straight to delete is how you lock out the accountant the week BAS is due — and then scramble inside the 30-day restore window.
Australian privacy (only if you’re an APP entity)
If you’re an APP entity, leftover guest access can sit under APP 11 “take reasonable steps” themes: know who can still reach personal information, and stop access you no longer need. Many small businesses under the $3 million turnover threshold are not automatically APP entities. There are exceptions. This is not legal advice — if you’re unsure, ask a lawyer, not a blog post.
Who can invite, and who owns the leftover
Guests keep existing because invitation is easy and offboarding is nobody’s job. Decide who is allowed to invite (often fewer people than you think), and put a sponsor on every guest you keep. When I do a Security Health Check for an Australian SMB, leftover guests are one of the first lists I pull. Fifteen minutes gets you the shortlist. The point is to stop ex-contractors living in your tenant by default.