Are guest access reviews mandatory in Microsoft 365?
No. Microsoft Entra access reviews only run when an administrator creates them, and they need Microsoft Entra ID P2 or Microsoft Entra ID Governance licences. An admin can create a recurring review of guests across all Microsoft 365 groups in one step, but nothing is switched on by default, and a review only removes access if it is set to apply its results.
Eighteen months ago a project team invited a dozen consultants into their SharePoint environment. The project finished. The consultants moved on. The external user records did not. Today those accounts still appear in every permissions report, and no one who owns the site remembers the engagement. Guest access reviews are Microsoft's answer to that drift, but only in tenants where someone has turned them on.
What Are Guest Access Reviews in SharePoint Online?
Guest access reviews are recurring checks configured in Microsoft Entra ID. Each one asks reviewers to confirm whether external users still need their access to a Microsoft 365 group, a team or an application. The reviewers can be the group owners, named people, the guests' managers, or the guests themselves.
Reviews live in the Microsoft Entra admin center under ID Governance > Access Reviews and work on group membership. Modern SharePoint team sites are backed by Microsoft 365 groups, so a guest removed from the group also loses the access that membership gave them to the site's libraries, lists and pages.
Creating one needs at least the User Administrator or Identity Governance Administrator role, and the tenant needs Microsoft Entra ID P2 or Microsoft Entra ID Governance licences.
Nothing Runs Until You Create It
No access review exists in a tenant until an administrator, or a group owner the admin has allowed to, creates one. Small tenants without an identity governance function often have none at all, which is how guest accounts from projects long finished survive for years.
The fastest way to cover every collaboration site is the All Microsoft 365 groups with guest users option. It creates recurring reviews of guests across every Microsoft 365 group and team in the tenant in one step, with a few limits worth knowing before you rely on it:
- Dynamic groups and role-assignable groups are not included, and you can exclude individual groups.
- The scope is guest users only.
- A denied guest is removed from the group. The option to block the guest's sign-in and delete the account after 30 days is not available for this review type; it needs a review of selected teams and groups.
- B2B direct connect users in Teams shared channels are not included.
Which Resources Are Covered
A review of a Microsoft 365 group or team covers what membership of that group grants:
- Modern SharePoint team sites: every group-connected team site has a backing Microsoft 365 group, and its guest members appear in the review.
- Teams-connected sites: a guest in a team is a guest member of its group, so the same review covers the team and its SharePoint site.
- Other group resources: the group's Planner plans and group mailbox come with membership, so removing a guest from the group removes those too.
What the review does not cover is directly-assigned SharePoint permissions. If a site owner gave a guest unique permissions on a library, list or folder, or shared a file with them, that grant bypasses group membership and the review cannot see it. This is where the longest-standing stale guest access tends to accumulate.
Configuring Reviews to Match Your Governance Needs
Recurrence and duration
You choose how often a review recurs and how many days each instance stays open for reviewers. Quarterly is a sensible cadence for most collaboration sites. Sites holding sensitive content, such as legal matters, financial models or HR records, justify a monthly review. Give reviewers long enough to act: a review window that closes while site owners are on leave produces nothing but non-responses.
Action on non-response
This is the setting that matters most. If reviewers don't respond decides what happens to every guest nobody reviewed:
| Setting | What happens to unreviewed guests | Best for |
|---|---|---|
| No change | Access stays as it is; the guest simply was not reviewed | A first review cycle, while you learn how reliably reviewers respond |
| Remove access | Access is removed when the review ends, if the review applies its results | Tenants that want stale guests gone and have reviewers who reliably respond |
| Approve access | Access is extended as if a reviewer had approved it | Rarely the right choice; it turns a missed review into a renewal |
| Take recommendations | Entra applies its own recommendation, for example deny for a guest with no sign-in in 30 days | Large reviews where a sign-in signal is a fair proxy for need |
Two settings work together here. Auto apply results to resource removes denied users automatically when the review ends; without it, an admin applies the results by hand. Microsoft warns that combining Remove access or Take recommendations with auto-apply can remove all access to a resource if reviewers fail to respond, so check who the reviewers are before you turn both on.
For reviews scoped to guests in selected teams and groups, Action to apply on denied guest users adds a stronger option: block the guest's sign-in for 30 days, then delete the account from the tenant. An admin can re-enable a guest blocked in error within those 30 days.
See the Share Link FinderWhat Happens After a Review: The Gaps That Remain
Even a well-configured access review leaves a significant gap. Guests removed from group membership keep any directly-assigned SharePoint permissions and any sharing links they hold. A consultant who was shared a library folder directly, rather than invited to the team, may not be a group member at all, and the review never touches that grant.
A complete guest access programme needs two parts working together: the Entra ID access review for group-based access, and a SharePoint permissions audit for direct assignments and sharing links. Run the audit at least quarterly, and more often in tenants where people share links freely.
ShareMaster's Share Link Finder covers part of that audit, one site at a time. Its Excel report lists each sharing link group on the site with its members, so a guest who still holds a link shows up, and a sheet per library lists the files and folders that carry sharing links or unique permissions. That shows, site by site, what access still exists after the review. For the complete external user audit workflow, see the guide to auditing SharePoint external users, and for every review setting and its default, the guest access review defaults reference.
Building Reviews Into Your Quarterly Admin Cadence
Treating access reviews as a one-time setup creates a false sense of security. A sustainable cadence looks like this:
- Before each review cycle: confirm the reviewers are still right. A site owner who has left cannot complete a review. Group owner reviews take the owners at the moment the review starts, so fix ownership before the window opens, and set a fallback reviewer for groups with no owner.
- During the review window: watch completion. Entra shows which reviews are in progress and which are overdue. Chase non-responding reviewers before the window closes.
- After each review cycle: run a SharePoint permissions report to catch the direct assignments and sharing links the group review missed, and remove access for any guest who appears there but was not renewed in the review.
- Annually: review the access review configuration itself: scope, recurrence, reviewers and the non-response action, as your tenant's external sharing changes.
The post-review permissions report is the step most admin teams skip, and it is precisely the step that finds access lingering for years after a project ends.
Frequently Asked Questions
Are guest access reviews mandatory in Microsoft 365?
No. Access reviews only run when an administrator creates them, and they need Microsoft Entra ID P2 or Microsoft Entra ID Governance licences. Nothing is switched on by default.
What are guest access reviews in SharePoint Online?
Checks you set up in Microsoft Entra ID that ask group owners, chosen reviewers or the guests themselves to confirm whether external users still need access to Microsoft 365 groups and Teams, and so to the SharePoint sites behind them. Denied guests can be removed automatically when the review ends, if the review applies its results.
Do guest access reviews cover directly-assigned SharePoint permissions?
No. A group review covers group membership. Guests given permissions directly on a SharePoint library, folder or file, or holding a sharing link, are outside it. A separate SharePoint permissions audit is needed to find and remove that access.
What happens when a reviewer misses the access review deadline?
Whatever the review's If reviewers don't respond setting says: No change, Remove access, Approve access, or Take recommendations. With Remove access or Take recommendations and auto-apply both on, unreviewed guests lose access when the review ends.
How does ShareMaster help with guest access cleanup after an access review?
ShareMaster's Share Link Finder covers the SharePoint side that access reviews miss, one site at a time. It reports the sharing links in the libraries you pick, with each sharing link group and its members, and the files and folders that carry unique permissions. On a Recycle Master or Clone Master licence it removes all those links, or restores inheritance, in one run.
Sources: Microsoft Learn, Create an access review of groups and applications and Manage guest access with access reviews.