Entra ID guest access for agencies: least privilege, with an expiry date

Look at the guest list in your Microsoft 365 tenant. Not the user list, the guests. For many Montreal companies it reads like an archive: a web agency from 2021, an accountant’s assistant who left that firm, three people with personal email addresses, and someone whose name nobody recognizes. Each one can still sign in.

Entra ID guest access for agencies is the discipline of letting outside firms work in your SharePoint, Teams, or apps without turning your tenant into a shared house. The method is dull and effective: invite into groups instead of individuals, scope the groups narrowly, give every guest an owner and an end date, and review on a calendar.

Guest, member, or something else

Microsoft Entra ID (formerly Azure AD) offers more than one way to let an outside person in. The choice matters:

• Guest (B2B collaboration). The person signs in with their own organization’s identity, or a one-time passcode, and appears in your directory marked as external. Best default for agencies and contractors.
• Member account in your tenant. A full internal identity. Reserve for people who are, in practice, your staff.
• Shared mailbox or shared login. Not an agency access method. Shared logins have no owner, no MFA you can trust, and no clean removal.

The recurring mistake is giving an agency a member account “because it was easier,” and then watching that account accumulate licences, groups, and mailbox access nobody revisits. Treat that as a finding, not a convenience.

Decide who is allowed to invite

By default, Entra ID can let many internal users invite guests. That convenience scales into a mess. Decide on purpose:

1. Who may invite external people (often a short list of admins or team owners, not everyone)
2. Which domains are allowed or blocked for collaboration
3. Whether personal email addresses are acceptable, and if so for what
4. What a guest can see in the directory (the external-collaboration settings can limit this)

Write those four answers on one page. It is the policy a future audit will ask for, and it is also the page that helps a new office manager say no to the fifth “just add them quickly” request.

Invite into groups, not into everything

A guest should land in a security group or Microsoft 365 group that maps to a project, not to the whole tenant. A pattern we use:

• One group per agency per engagement, named so the owner is obvious (for example, `EXT-Agency-Website-2026`)
• Access to one Teams channel or one SharePoint library, not the root site
• No access to the full address book beyond what the project needs
• No licences unless the guest truly needs a workload that requires one
• A named internal owner who answers for the group

The group is what you review and what you delete. When the contract ends, removing the group removes the access paths in one move, instead of hunting through individual sharing links.

Require MFA, and say whose MFA it is

Guests can authenticate with their home organization’s identity, which often has MFA, or they can be forced to satisfy MFA in your tenant through Conditional Access. This is a decision to make explicitly:

• Accept their MFA through cross-tenant access settings, if you trust that tenant’s controls
• Require your MFA for guests on sensitive resources
• Block guests from certain apps entirely

At minimum, require MFA for external users through a Conditional Access policy and test it with a real guest account before announcing the change. The reasoning is the same one in our piece on MFA, logs, and restorable backups: a single vendor without a second factor undoes the work you did on staff.

Put an expiry on every guest

“Temporary” is not a status Entra ID understands. A date is. Practical steps:

• Match the access end date to the statement of work, plus a short grace period for handover
• Use access reviews in Entra ID Governance (where your licensing includes it) to ask group owners each quarter whether each guest should stay
• Where licensing does not cover reviews, keep a simple register of guests, owners, and end dates, and review it by calendar reminder
• Treat “no response from the owner” as “remove,” not “keep”

Some features, such as automated access reviews, depend on the Entra ID plan you hold. We check what your licences cover before promising automation, and fall back to a lightweight manual process when they do not.

Offboarding that actually offboards

Removing a guest object is the last step, not the only step. The checklist:

1. Remove the guest from all groups and Teams
2. Revoke active sessions and refresh tokens
3. Review and remove external sharing links they created or received
4. Check for mailbox forwarding rules or app registrations they owned
5. Transfer ownership of files, channels, or flows to an internal person
6. Delete the guest account and note the date in the register
7. Confirm removal by trying to access a resource as that person, where you can

If the agency also held credentials outside Entra ID (the website admin, the CRM, the DNS provider), those need to be removed in the same session. Otherwise the tenant looks clean while the real access sits elsewhere.

What a review turns up

The first quarterly review usually finds the same few things: guests with no owner, guests whose company no longer works with you, groups that grew past their purpose, and shared links open to “anyone with the link.” None of these are exotic. They are the normal result of three years of “add them quickly.”

Fixing them is a two-hour job when the register exists and a two-week archaeology project when it does not.

Where this sits in the workplace

Guest access is one part of how a 365 tenant should be run: licences that match people, identity with MFA, mail and files with clear owners, and devices that can be wiped. Our overview of the Microsoft 365 and Azure workplace shows the whole picture. If you would rather not run it yourself, hands-off IT in Montreal is how we operate it day to day.

What we need to start

• Read access to the tenant’s guest list and Conditional Access policies
• The list of agencies and contractors who should still have access
• A named internal owner for each
• The contract end dates, or an honest “we are not sure”

We are in Montreal and answer weekdays, 9 to 17 ET. Send your guest list to hello@aervio.io or call +1 438-498-3913, and we will return the ones that look unowned, expired, or too broad. Our Microsoft 365 and Azure services cover the setup and the quarterly review.

Questions

Should an agency get a guest account or a full member account?

A guest account in almost every case. Guests can be scoped to specific groups, teams, or sites, they carry a clear external marker, and they can be removed without touching your internal directory. A member account for an outside firm tends to collect permissions and never leave.

Do guests need MFA?

Yes. Require it through Conditional Access for guest and external users, and decide whether you accept their home-tenant MFA or require your own. Either way, written down, not assumed.

How long should guest access last?

As long as the contract, plus nothing. Set an expiry matched to the statement of work, assign an internal owner, and run an access review each quarter. Renewal is a deliberate yes, not a default.