External users granted SharePoint access last year are still there. Contractors who left in February still have guest accounts. A partner organisation whose project ended months ago still has active site membership. In most Microsoft 365 tenants this is the default state - not because admins are negligent, but because SharePoint makes it easy to grant access and hard to systematically revoke it at scale. This guide walks through every step to identify and remove stale external users before your next audit or compliance review.
What qualifies as a stale external user?
There is no universal definition, but most governance frameworks treat an external user as stale when at least one of these conditions is met:
- No sign-in activity to your Microsoft 365 tenant in the last 90 days.
- The engagement, contract, or project they were invited for has ended.
- The person no longer works for the organisation they represented when access was granted.
- An Entra ID guest access review flagged the account as no longer needed.
Microsoft Entra ID's guest access review feature can surface all four conditions automatically - but only if access reviews are configured and running. Most tenants that pre-date 2025 have not enabled them. For those environments, the audit must be done manually or with tooling.
Guest accounts vs sharing links
Before starting, it helps to separate two distinct problems. A guest account is a Microsoft Entra ID B2B user object created when someone was explicitly invited to access SharePoint or Microsoft 365. A sharing link is a URL - an "Anyone" or "Specific people" link - that grants access to a file or folder without necessarily creating an account.
Removing a guest account does not delete sharing links. You may need to address both. This guide focuses on guest accounts. For the sharing link side, see how to audit and remove SharePoint sharing links.
Audit before you remove anything
Deleting the wrong account can break an active vendor's access to a live project. A two-step audit takes 20 minutes and prevents incidents.
- Export all external users across your tenant. In the SharePoint admin center, go to Users and filter by "External users." Export the list as CSV. Alternatively, use Report Master to generate a full external user permissions report that maps each guest to every library and folder they can access - giving you the context to judge whether the account is still active, not just whether it exists.
- Cross-reference with Entra ID last sign-in data. In the Microsoft Entra ID admin center, go to Users, filter by "Guest" account type, and export with the last sign-in date column. Join this list with your SharePoint user export to flag accounts with no sign-in in 90 or more days.
How to remove stale external users from SharePoint Online
Three paths exist, ranging from point-and-click to fully scripted. Choose the one that matches your volume and technical environment.
Option 1: SharePoint admin center (small scale)
- Sign in to the Microsoft 365 admin center and navigate to SharePoint admin center > Users.
- Filter the list by "External users" using the account type dropdown.
- Select the accounts you want to remove. Use shift-click for ranges.
- Click Delete users in the action bar.
This removes them from SharePoint's external user registry, revoking their site collection access across your tenant. It does not delete their Microsoft Entra ID guest account. If you want to remove them from your directory entirely, do that separately in the Entra ID admin center - but only if they have no other access to your tenant's Microsoft 365 services.
Option 2: PowerShell (medium scale, repeatable)
For tenants with dozens or hundreds of stale accounts, PowerShell is faster than clicking through the admin center.
# List all external users across the tenant
Get-SPOExternalUser -PageSize 50 | Select DisplayName, Email, WhenCreated
# Remove one specific external user by their unique ID
Remove-SPOExternalUser -UniqueIDs paste-guid-here
# Bulk remove from a CSV of GUIDs exported during your audit
$toRemove = Import-Csv "stale-guests.csv" | Select -ExpandProperty UniqueId
Remove-SPOExternalUser -UniqueIDs $toRemove
PnP PowerShell provides additional flexibility. Use Get-PnPUser per site collection and loop across your full tenant site list to build a more granular picture before removing. Connect with Connect-PnPOnline using app-only credentials for unattended scripts.
Option 3: ShareMaster Shared Links & Permissions (large scale)
When the audit reveals stale accounts spread across many sites, the manual options become error-prone and slow. ShareMaster's Shared Links & Permissions tool surfaces every external permission and sharing link across your tenant in a single filtered view. From there you can select multiple external users, see exactly which sites and libraries each one can access, and remove their permissions in bulk - across all sites simultaneously - in one operation.
After removing the guest accounts, the same view lets you clean up sharing links associated with those users without switching tools.
See how Shared Links & Permissions works
After removal: what to verify
Run the external users report again immediately after the cleanup. Confirm the account count has dropped by the expected number. If an account still appears, check whether a sharing link re-invited the user automatically - this can happen if an active "Specific people" link was resent after the account removal.
Pull the audit log from the Microsoft Purview compliance portal as well. External user removal events appear under the "Sharing" category in the unified audit search. The timestamp and acting-admin record provide the evidence trail you need for compliance sign-off.
Finally, if your organisation has an Entra ID guest access review configured, mark the removed accounts as "Denied" in the review so the audit trail reflects an intentional decision rather than a system expiry.
Preventing stale guest buildup going forward
Removal is a one-time fix. Prevention stops the problem from rebuilding. Three controls make the biggest difference:
- Set a sharing link expiry policy. In the SharePoint admin center under Sharing settings, configure "Anyone" links to expire after 30 or 60 days. Links that expire stop creating persistent access automatically.
- Enable Entra ID guest access reviews. Quarterly reviews send review tasks to site owners, who confirm or deny continued access for each guest. This pushes the decision to the people closest to the work.
- Tie guest access to project lifecycle. When a project, contract, or vendor engagement closes, include an access revocation step in the offboarding checklist. Removing access at project close takes two minutes; discovering forgotten access in an annual audit can take days.
Frequently Asked Questions
Does removing a SharePoint external user also delete their Microsoft Entra ID guest account?
Not automatically. Removing them from the SharePoint admin center revokes their SharePoint access but leaves the Entra ID guest account intact. To remove them from your directory entirely, delete the guest user object in the Entra ID admin center separately - and only if they have no other Microsoft 365 access in your tenant.
How do I find external users who have not signed in for 90 days?
In the Microsoft Entra ID admin center, go to Users, filter by guest account type, and export with the last sign-in date column. Sort by that column and flag accounts older than 90 days or with no date at all. ShareMaster Report Master can cross-reference these accounts with site-level access data so you know which sites each stale user still has access to before you remove them.
What is the difference between revoking site access and removing the guest account?
Revoking site access removes the person from a specific site's user list but leaves their Entra ID guest account intact - they can be re-invited to other sites. Removing the Entra ID guest account deletes the user object entirely, terminating all SharePoint and Microsoft 365 access. For a full cleanup, you need both: revoke their specific site permissions and delete the Entra ID guest account.
Will removing stale guests affect sharing links those users received?
Removing the guest account revokes that person's access to links sent specifically to them as a named user. However, anonymous "Anyone" links they may have previously received or created remain valid for anyone with the URL until the links are explicitly deleted or your expiry policy triggers. Always audit and clean up sharing links after removing guest accounts - these are two separate cleanup tasks.