Three hundred and forty external accounts. That was the number Daniel counted when he ran his first tenant-wide permissions export six months into his new role as IT admin for an engineering consultancy with 450 staff. Many were from client projects that had closed two years earlier. Some pointed to people who no longer worked for those clients. A handful were Entra ID guest accounts with no SharePoint permissions at all. None of it had been cleaned up, because nobody had ever looked.
Why stale guest accounts accumulate in SharePoint Online
Guest accounts are easy to create and invisible to end users once set up. A project manager shares a document library with a client's team. The project ends, the manager moves on, and the guest accounts remain - quietly holding access to files that should have been locked down months ago.
Microsoft 365 does not expire guest access automatically by default. Entra ID supports access review policies that prompt guests to reconfirm their need for access on a schedule, but these must be deliberately configured. Without that setup, or without a manual cleanup habit, external accounts accumulate across every active and archived site in the tenant.
The security and compliance risk
A guest account that outlives its purpose carries several concrete risks. The guest may still be able to access files that were shared directly with them, even if the site has since been archived or the project has formally closed. If the guest's own Microsoft 365 account has been compromised at their organisation, that compromised account now has a path into your SharePoint tenant.
Shared links add a second layer of risk. When someone uses the "Share" button to send a link to a specific person, SharePoint creates a unique permission grant tied to that recipient. These grants survive site restructuring, permission inheritance changes, and even the removal of the original sharing user. Without a tool that queries the links themselves, most of them go unreviewed indefinitely.
For organisations in regulated industries, the exposure is also a data governance issue. Demonstrating that external access is reviewed and appropriate is a standard control requirement. Discovering 340 unchecked guest accounts during an external audit is far more disruptive than finding them yourself.
Step 1: Get the complete picture with a permissions export
Daniel's first task was getting the data. The SharePoint admin center lists external users per site but there is no built-in way to export them all to a single file with useful context: which libraries each guest accesses, what permission level they hold, and when each site was last used.
He used Report Master to generate a permissions matrix for the tenant. The export covered every site collection, mapped each unique permission grant to a named user or group, and flagged guest accounts separately using their external email format. The result was a filterable Excel file that became the working document for the entire cleanup project.
Step 2: Categorise and prioritise
Not all 340 accounts were equal. Daniel split them into three buckets based on site activity and project status:
| Category | Description | Action |
|---|---|---|
| Active project guests | External users on sites with activity in the past 90 days, project still open | Review scope of access; no immediate removal |
| Completed project guests | External users on closed project sites, no site activity for 6 or more months | Remove all SharePoint access; notify project sponsor |
| Orphaned guests | Entra ID guest accounts with no current SharePoint permissions anywhere in the tenant | Delete from Entra ID directly; no SharePoint action needed |
The triage took about half a day, working from the permissions export cross-referenced against the firm's project management system. Of the 340 accounts: 89 were active, 191 were completed-project guests, and 60 were orphaned with no SharePoint access remaining.
Step 3: Revoke shared links and permissions at scale
SharePoint permissions come in two forms: site membership grants and direct sharing links. Both needed clearing for the 191 completed-project guests. Doing this through the SharePoint admin center meant opening each site individually, navigating to its sharing settings, and removing each user one at a time. With 191 accounts spread across dozens of sites, that was not viable in a single afternoon.
The Shared Links and Permissions tool in ShareMaster let Daniel search across the tenant by recipient email address. For each guest, he could see every sharing link pointing to them and every direct permission grant. He selected all entries for a given guest and revoked them in one batch operation. The entire 191-account batch took under two hours.
Try ShareMaster free for 14 days
Step 4: Remove the Entra ID accounts
Revoking SharePoint access leaves the guest account in Entra ID intact. The account may still sign in to other Microsoft 365 services if it holds access elsewhere, and it remains in the tenant's directory. Daniel worked with the firm's Global Administrator to remove the 191 completed-project accounts and 60 orphaned accounts from the Entra admin center.
For organisations with large volumes, PnP PowerShell can batch-delete guest accounts using a CSV file as input, which is significantly faster than the Entra UI for bulk removals. The CSV can be exported directly from the Report Master permissions export by filtering on the guest account column.
The outcome and the ongoing policy
After the cleanup, the tenant went from 340 external accounts to 89. A follow-up check six months later found 31 new guest accounts, all associated with active engagements. The difference came not from better tooling alone but from a revised process: project managers now complete a SharePoint access checklist at project close-out, and the IT team runs a quarterly permissions export as a standing routine.
The quarterly export takes about fifteen minutes in Report Master. The shared-link sweep with Shared Links and Permissions runs alongside it. Neither step is automated in the full sense, but both are repeatable and fast. For a lean IT team managing a busy professional services firm, that is the right balance.
For the step-by-step guide to running an external user audit, see how to audit external users in SharePoint Online.
Frequently Asked Questions
How do I see all external users across all SharePoint sites in one place?
The SharePoint admin center lists external users per site but has no tenant-wide export. Report Master generates a single Excel file covering every site collection, including each guest's permission level and the libraries they can access.
What counts as a stale external user in SharePoint Online?
There is no official Microsoft definition. Most admins treat a guest as stale if they have not signed in for 90 days and the project or engagement that created the invitation is no longer active. Entra ID shows the last sign-in date for each guest account.
Does removing a SharePoint guest also delete their Entra ID account?
No. Removing a guest from SharePoint or revoking their shared links removes their SharePoint access, but the guest account in Entra ID remains. A Global Administrator or User Administrator must also delete it from the Entra admin center to fully remove the account from the tenant.
Can I bulk-remove shared links for an external user across all sites at once?
ShareMaster's Shared Links and Permissions tool lets you search all shared links and unique permission grants across the tenant, filter by recipient, and revoke them in bulk. The built-in SharePoint admin center removes links one site at a time only.