Guest access to SharePoint content is governed at the Entra ID layer, not inside SharePoint itself. The settings below cover the defaults and options that shape how long a guest keeps access and who has to sign off on keeping it that way.
Access Review Recurrence Options
Microsoft Entra ID Governance access reviews can be scheduled at several intervals, each with its own tradeoff between administrative overhead and how quickly a stale account gets caught.
| Recurrence | Default state | Best fit |
|---|---|---|
| One-time | Not scheduled by default | Ad hoc cleanup after a project ends or an acquisition closes |
| Weekly / Monthly | Not scheduled by default | High-sensitivity sites with frequent guest turnover |
| Quarterly | Not scheduled by default | General-purpose governance baseline for most tenants |
| Semi-annual / Annual | Not scheduled by default | Low-turnover partner relationships, compliance attestation cycles |
None of these run automatically. An Entra ID administrator with a Governance or P2 licence has to create the review, choose the scope (a Microsoft 365 group, a set of guest users, or an application), and assign reviewers before anything happens.
Reviewer Assignment Models
| Model | Who reviews | Notes |
|---|---|---|
| Self-review | The guest confirms their own continued need for access | Fastest to set up; relies on the guest actually responding |
| Group owner | Owner of the Microsoft 365 group or team the guest belongs to | Common default for group-based guest access |
| Sponsor | The internal employee who originally invited the guest | Requires sponsor data to be accurate at invitation time |
| Selected reviewers | A named administrator or small group | Best for small, high-sensitivity guest populations |
Guest Account Expiration
Separate from access reviews, Entra ID External Identities offers a guest user access expiration setting that automatically disables a guest account after a configured number of days (30 to 730), independent of any review process. It is off by default. When enabled, it acts as a backstop that catches guests nobody ever got around to reviewing manually.
Auto-Apply Behaviour When a Review Completes
| Setting | Effect |
|---|---|
| Auto-apply results, remove denied access | Access is revoked automatically the moment a reviewer denies it, with no further approval step |
| Auto-apply results, act on no response | Non-responding guests are treated as denied (or approved, depending on configuration) once the review period closes |
| Manual apply | An administrator reviews the outcomes and decides case by case before anything changes |
Manual apply is the safer default for a first review cycle in any tenant, since it lets the administrator catch a misconfigured scope before real accounts lose access. Once a tenant has run a few review cycles and trusts the scope is correct, moving to auto-apply reduces the ongoing manual workload considerably.
Building the Guest List a Review Needs
An access review is only as accurate as the guest list behind it. Before creating one, most admins want a current export of exactly which guests hold access to which SharePoint sites and at what permission level, rather than relying on the review's own scoping to surface that. ShareMaster's Report Master exports a full external user list per site to Excel, which is a useful cross-check against what an access review scope actually captures before reviewers start receiving requests. For sites where inheritance has drifted and unique permissions have piled up outside of what a group-based review would catch, the unique permissions reference explains how those grants accumulate.
Frequently Asked Questions
Are SharePoint guest access reviews turned on by default?
No. They are an Entra ID Governance feature that an administrator must create deliberately. No default recurring review runs until one is configured.
What licence is required for Entra ID access reviews?
Microsoft Entra ID P2 or a Governance add-on licence covering the relevant users. They are not included in base Microsoft 365 plans without that added licence.
What happens to a guest account if a review is not completed?
It depends on the review's auto-apply setting: access can be removed automatically on denial or no response, or the account can simply be flagged for a human decision with no automatic change.