4 Ways to Clean Up Stale SharePoint Guest Access

Four approaches exist for identifying and removing external users who no longer need access to SharePoint Online. Here is how they compare:

Method	Skill required	Bulk removal	SharePoint-specific view	Extra licence	Scheduling
Entra ID admin center (manual)	Low	No	No	None	Manual only
Entra ID Access Reviews	Low-Medium	Yes (auto)	No	Entra ID P2	Recurring
PowerShell	High	Yes	Per site collection	None	Script scheduling
ShareMaster (Report Master + Shared Links & Permissions)	Low	Yes	Yes	ShareMaster paid licence	On-demand

What Is a Stale SharePoint Guest Account?

A stale guest account is a Microsoft Entra ID guest user whose business reason for access no longer applies: a contractor whose project has ended, a vendor whose contract was not renewed, a former partner from a completed joint venture. The account still exists in Entra ID and still has whatever SharePoint Online permissions it was originally granted, but the person on the other side should no longer be logging in.

Stale guest access is one of the most common gaps in SharePoint permission audits. External invitations are easy to create and easy to forget. Without a regular review process, tenants accumulate years of guest accounts from past projects, with no clear record of which sites each account can still reach.

Option 1: Entra ID Admin Center (Manual Review)

How it works

In the Microsoft 365 admin center, navigate to Users, then Guest Users. The list shows all Entra ID guest accounts in the tenant, along with their sign-in date, invited by, and current status. Admins can filter by last sign-in date to surface accounts that have not been active in 90 days or more, then delete them one at a time or in small batches using the multi-select checkbox.

Deleting a guest account removes the Entra ID object, which revokes that person's ability to authenticate and access any SharePoint Online or OneDrive for Business content they were sharing access for. Anonymous sharing links they received remain active until revoked separately.

Best for

One-off cleanup of a small number of obviously stale accounts. Suitable for smaller organisations with a handful of external collaborators who can be reviewed in a single session.

Limitations

• No visibility into which SharePoint sites or libraries each guest account can currently reach. You see the account but not its access scope.
• Last sign-in date alone is not a reliable indicator of whether access is still needed. A guest who signed in last month may still have an active contract; one who has not signed in for six months may no longer be a contractor.
• No bulk removal for large lists without selecting each account manually.
• No SharePoint-level view of unique permissions or site memberships. Removing the account in Entra ID does not guarantee that the sharing links they used are also cleaned up.

Option 2: Entra ID Access Reviews (Identity Governance)

How it works

Entra ID Access Reviews, part of Microsoft Entra ID Governance, automate the periodic review of guest user membership across groups and applications. An admin configures a review campaign: frequency (monthly, quarterly, annual), scope (all guests, or guests in specific groups), and reviewer assignment (manager of the inviting user, or specific designated reviewers). Reviewers receive an email prompting them to approve or deny continued access for each guest. Accounts not approved within the review window can be automatically disabled or deleted.

Access Reviews are the right tool when your organisation needs a documented, repeatable process with assigned accountability. The review history is auditable, which satisfies regulatory requirements in some industries.

Best for

Organisations with large numbers of guests who need a structured, compliance-backed review cycle. Enterprise tenants with Entra ID P2 licences already included in Microsoft 365 E5.

Limitations

• Requires an Entra ID P2 licence (included with Microsoft 365 E5, or available as a standalone add-on).
• Reviews operate at the Entra ID group or application level, not at the SharePoint site or library level. Reviewers see whether to keep the guest account, not which specific SharePoint content the account can reach.
• Configuration is straightforward but requires initial setup time and reviewer training to avoid rubber-stamping approvals.
• Anonymous sharing links (Anyone links) are out of scope for Access Reviews. They must be managed separately.

Option 3: PowerShell

How it works

The SharePoint Online Management Shell provides two cmdlets for external user management. Get-SPOExternalUser lists the external users who have accepted a sharing invitation for a specific site collection. Remove-SPOExternalUser removes a named external user from a specified site collection. For Entra ID-level removal, the Microsoft Graph PowerShell SDK's Remove-MgUser cmdlet deletes the guest account entirely. Combining these allows a scripted workflow: query all site collections for external users, filter by last sign-in date via Microsoft Graph, then remove stale accounts.

PowerShell also supports bulk operations. A script can loop through all site collections, export external users to CSV, cross-reference against an HR system for contractor status, and remove accounts that meet the stale criteria, all in a single run.

Best for

Administrators comfortable with PowerShell who need to automate the process or integrate it with other systems. Also the right choice when no additional licence budget is available.

Limitations

• Requires scripting knowledge and access to both SharePoint Online Management Shell and Microsoft Graph PowerShell SDK.
• Get-SPOExternalUser must be run per site collection. Retrieving all external users across a large tenant requires looping through every site collection, which takes time and can hit throttling limits.
• No built-in way to view unique permissions at the library or folder level from the external user report. Identifying exactly what content a guest can reach requires additional PnP PowerShell queries.
• Scripts require maintenance as Microsoft API surfaces evolve. A working script today may need updates after a SharePoint or Graph API change.

Option 4: ShareMaster Report Master and Shared Links & Permissions

ShareMaster combines two tools to handle the full workflow: identifying stale guest access and then removing the SharePoint-side permissions that granted it.

Report Master exports a permissions matrix per site collection, mapping each external user to the specific site collections, libraries, and content they have access to. This gives you the SharePoint-level view that the Entra ID admin center and Access Reviews do not provide. The export is a formatted Excel workbook, ready to share with a manager or project owner for a sign-off decision.

Shared Links and Permissions handles the removal side: bulk-removing sharing links and unique permission entries that granted external access. Once the decision is made (this guest account's access should be revoked), the tool removes the SharePoint-side permissions without requiring scripting.

This combination addresses a gap in the other methods. Deleting a guest account in Entra ID stops the person from authenticating. But sharing links they were given, and the unique permissions entries that remain in site collections, still appear in SharePoint's data model until they are also removed. Cleaning up both the account and the residual permission entries produces a cleaner audit trail and removes any risk from anonymous links that remain active after the account is gone.

See what Report Master exports

Best for

SharePoint administrators and MSPs who need to audit guest access across multiple site collections and then act on the results without scripting. Particularly useful in advance of compliance audits, M&A activity, or periodic governance reviews. See the step-by-step guide to auditing external users in SharePoint Online for a full walkthrough.

Decision Matrix: Which Option for Which Scenario

Scenario	Best option
Remove 3-4 obviously stale guest accounts now	Entra ID admin center (manual)
Recurring quarterly review with documented approval chain	Entra ID Access Reviews (requires P2)
Bulk removal scripted against HR system, large tenant	PowerShell (Graph + SPO Management Shell)
See exactly which libraries each guest can access before acting	ShareMaster Report Master
Remove sharing links and unique permissions after revoking accounts	ShareMaster Shared Links and Permissions
MSP managing guest cleanup across multiple client tenants	ShareMaster (connected per tenant) or PowerShell scripting
Pre-audit cleanup: demonstrate no unnecessary external access	ShareMaster Report Master (export) then Shared Links and Permissions (removal)
Organisation on Microsoft 365 Business Standard with no P2 licences	PowerShell or ShareMaster

Frequently Asked Questions

How do I find all external users across SharePoint Online?

Options include the SharePoint admin center's active sites report filtered for guest access, the Get-SPOExternalUser PowerShell cmdlet run per site collection, and the Entra ID guest user list in the Microsoft 365 admin center. None of these give you a combined view of which specific libraries or folders each guest can reach across all site collections in one export. ShareMaster Report Master exports that cross-site permissions matrix to Excel from a single connected session.

What is the difference between a SharePoint guest account and an external sharing link?

A guest account is a Microsoft Entra ID guest user (B2B guest) created when someone external is invited to access SharePoint. A sharing link is a URL that grants access to a file or folder without requiring the recipient to have an account. Removing guest accounts and removing sharing links are two separate tasks: deleting the account stops the person from authenticating, but anonymous or open sharing links they were given may still be accessible to anyone with the URL.

Does removing a guest account from Entra ID also remove their SharePoint permissions?

Deleting the guest account from Entra ID revokes their ability to sign in, which prevents access to any SharePoint Online content they were granted as a named user. However, anonymous sharing links (Anyone links) they may have previously used remain active until individually deleted or until a link expiry policy triggers. Cleaning up the account and the residual sharing links are separate tasks and both should be addressed in a thorough cleanup.

How often should SharePoint guest access be reviewed?

A quarterly review is a common baseline. Organisations in regulated industries often review monthly. A practical trigger: at project or contract end, revoke the relevant guest accounts immediately rather than waiting for the next scheduled review cycle. ShareMaster Report Master can generate an on-demand external user report at any point, making event-driven reviews just as easy as scheduled ones.

For a hands-on walkthrough of the audit side of this process, see the MSP multi-tenant permissions audit use case.

Try ShareMaster free for 14 days