The average Microsoft 365 tenant grows its external guest account count by roughly 30 percent a year even when no new major projects are underway. Most admins who run a full external user audit for the first time are surprised by the number they see. The surprise is not a failure of vigilance. It is the predictable result of how SharePoint Online is designed to work - and of the gap between how access gets granted and how it gets reviewed.
How external access accumulates, step by step
Guest access in SharePoint does not arrive in one big wave. It arrives in a hundred small ones, each individually justified, none individually alarming.
A project manager shares a document library with a contractor. The contractor finishes the job three months later, but the library link is never revoked. A team lead adds an agency contact as a site visitor so they can review a campaign brief. The campaign ships, the agency relationship ends, the site visitor record remains. Someone shares a specific file with a client via "Specific people" - a link that automatically creates a guest account in Microsoft Entra ID. The client reads the file and never logs in again, but the account persists.
None of these actions required admin involvement. SharePoint Online allows business users to create guest accounts as a side effect of normal file sharing. Entra ID external collaboration settings can require admin consent for new guest invitations, but many tenants run with that gate open because requiring admin approval for every external share creates friction that slows actual work down.
The result: guest accounts accumulate continuously, while removal almost never happens automatically. Microsoft does not delete guest accounts when a sharing link expires. Microsoft does not delete guest accounts when a project site becomes inactive. Microsoft does not delete guest accounts when an organisation updates its vendor list. All of that cleanup is a manual or tooled admin task that most tenants do rarely - if ever.
Why standard controls do not catch it
Several features exist in Microsoft 365 that appear to address this problem. In practice, each has a gap that leaves stale access in place.
Sharing link expiry policies can force "Anyone" links to expire after a set number of days. This helps with anonymous links. It does not remove the guest account created when a "Specific people" link was used. The link expires; the account remains.
Entra ID guest access reviews send review tasks to site owners or group owners on a quarterly schedule, asking them to confirm or deny continued access for each guest. This is the most effective native control - but it requires someone to configure it, someone to respond to review emails, and site owners who are engaged enough to make accurate decisions about guests they may have invited years ago and forgotten. In many tenants, review emails go unanswered, and Entra ID auto-approves access when a reviewer does not respond within the review period.
Microsoft 365 inactive site policies can flag sites that have had no activity in a defined period and notify site owners. But a site with stale guest members is not necessarily inactive - it may have plenty of internal activity while external users sit forgotten in the member list.
The Microsoft 365 admin center external user report shows who has guest access, but it is a flat list with no last-active-in-SharePoint field. It tells you the account exists; it does not tell you whether the person is still relevant to your organisation.
What an unchecked guest list looks like at 18 months
Consider a mid-size organisation with 300 internal users. Over 18 months of normal operations - sharing documents with clients, working with contractors, running projects with external partners - they accumulate roughly 180 external guest accounts. Forty of those are still active: ongoing vendor relationships, a long-running client project, a few contractors on retainer. The other 140 are ghosts.
Of those 140 ghost accounts, 60 have sharing links still active pointing to files they can access with the right URL. Thirty of those files sit in libraries that also contain other sensitive content - not the file the link points to, but content accessible to anyone with site-level membership, which some of those guests have.
None of this is intentional. No one decided to leave an ex-contractor's guest account pointing at a live library. It happened because the offboarding checklist did not include SharePoint access revocation. Or because the project manager who invited the contractor left the organisation before the project closed and took the institutional knowledge of that access with them. Or simply because no one ever ran the report.
This scenario is not rare. It is the median state of a SharePoint tenant that has not run a dedicated external access audit. The number of guests and the duration vary; the structural cause is the same.
Getting control without building a large audit project
The temptation when discovering a large stale guest list is to treat it as a big project: map every account, consult every business unit, build a governance framework before touching anything. That approach usually means nothing gets cleaned up for six months while the project is being planned.
A faster path is to start with the accounts most likely to be safe to remove: guests with no Entra ID sign-in in the last 90 days. This group almost never includes active vendor relationships. Export it, spot-check five or ten accounts with the relevant business owners, and remove the rest. You can always re-invite someone if the removal turns out to be wrong; you cannot undo a data exposure that happened while you were waiting to plan.
The practical steps for doing this quickly are covered in the step-by-step guide to removing stale SharePoint external users. For a comparison of the available tooling options across the manual, scripted, and ShareMaster paths, see the guest access cleanup options compared page.
After the initial cleanup, three controls keep the list manageable going forward. Configure sharing link expiry for "Anyone" links at 30 or 60 days. Enable Entra ID guest access reviews on a quarterly cadence and assign a real owner to each review - not a generic admin account. Add SharePoint access revocation as a line item in your offboarding and project-close checklists. None of these is complex. Together they change the default from "access persists until someone notices" to "access expires unless actively renewed."
Try ShareMaster free for 14 days
Frequently Asked Questions
How do I find out how many external guest users my SharePoint tenant has?
In the SharePoint admin center, go to Users and filter by External users for the tenant-wide headcount. In Microsoft Entra ID, go to Users and filter by Guest account type to see last sign-in dates alongside the account list. ShareMaster Report Master produces a cross-site permissions report that maps each external user to every site and library they can currently access - more useful than a headcount when you are planning a cleanup.
Why does SharePoint keep creating guest accounts I did not explicitly approve?
SharePoint Online creates a guest account automatically when a file is shared with an external email address via a "Specific people" sharing link, when an external user is added to a SharePoint site, or when an external person is added to a Teams team backed by SharePoint. None of these require admin approval unless you configure Entra ID external collaboration settings to require admin consent for guest invitations - a control that trades user friction for admin oversight.
What is the fastest way to reduce stale SharePoint guest accounts?
Export your external user list, cross-reference with Entra ID last sign-in data, and bulk-remove accounts with no sign-in in 90 or more days. Use the SharePoint admin center for small batches, PowerShell with Remove-SPOExternalUser for larger ones, or ShareMaster Shared Links & Permissions for a cross-tenant view with bulk removal in a single operation.