Review guest access periodically

Description

A recurring access review covers the guest members of every Microsoft 365 group (and team), every {{ guest_review_frequency }}. The review:

• targets Guest users only in All Microsoft 365 groups with guest users;
• has internal reviewers (group owners, with a fallback reviewer), never the guests themselves;
• enables mail notifications and reminders, and requires a reason on approval;
• lasts 14 days or less and recurs with no end date;
• applies results automatically and removes access when reviewers do not respond.

Guests removed from all groups can be blocked and then deleted with the review option Block user from signing-in for 30 days, then remove user from the tenant in a separate review scoped to all guest users.

Rationale

Guests are added for a project and rarely removed when it ends. A review that removes access by default when nobody vouches for the guest keeps the external population limited to active collaborations, and documents who approved what.

Impact

Owners review their guests each cycle; a missed review removes legitimate guests, who must be invited again. Reviews of guests need Microsoft Entra ID Governance or P2 licensing, and Microsoft bills guest governance features through a linked Azure subscription.

Applies when

Requires: Microsoft Entra ID P2

Parameters

The value used is your override (tailoring file), else the profile's, else the one of the profile it extends, else the default. Bounds limit what an override may set.

Audit

1. Sign in to the Microsoft Entra admin center (https://entra.microsoft.com) as at least a Global Reader.
2. Browse to ID Governance > Access reviews and open the reviews of Teams + Groups.
3. Find an active review with scope All Microsoft 365 groups with guest users and Guest users only, and check: reviewers are internal; Frequency {{ guest_review_frequency }} or more frequent; Duration 14 days or less; End Never; Mail notifications, Reminders, Require reason on approval and Auto apply results to resource enabled; If reviewers don't respond Remove access.
4. Read-only alternative with Microsoft Graph (scope AccessReview.Read.All): GET /identityGovernance/accessReviews/definitions and look for a definition whose scope filters userType eq 'Guest' across Microsoft 365 groups.
5. Fail if no such review exists or if one criterion is not met.

Remediation

1. With an Identity Governance Administrator, browse to ID Governance > Access reviews > New access review.
2. Select what to review: Teams + Groups; Review scope: All Microsoft 365 groups with guest users; Scope: Guest users only.
3. Reviewers: Group owner(s), with a fallback reviewer.
4. Recurrence: {{ guest_review_frequency }}, Duration 14 days or less, End Never.
5. Upon completion settings: Auto apply results to resource enabled; If reviewers don't respond: Remove access.
6. Enable reviewer decision helpers and, under Advanced settings, Justification required, Email notifications and Reminders. Select Create.

Rollback

Stop or delete the access review; removed guests must be invited again.

References

• Manage guest access with access reviews Microsoft, vendor-doc, accessed 2026-10-24
• Create an access review of groups and applications Microsoft, vendor-doc, accessed 2026-10-24

Mappings

How this control relates to the other framework's: equivalent, stricter, looser, partial or related.

Related controls

• related CB-M365-TENANT-010 Restrict guest access to their own directory objects
• related CB-M365-ADMIN-012 Do not assign privileged roles to guest users
• related CB-M365-COLLAB-011 Expire guest access to sites and OneDrive automatically

People and lifecycle