Every guest account in your tenant arrived for a reason — a project, an audit, a supplier portal. Almost none of them leave for a reason. There is no off-boarding for other people's employees, so the guest list only grows. Here's the lifecycle, where the risk concentrates, and a review routine that survives contact with a busy quarter.
The lifecycle nobody owns
- Invitation. Someone shares a file or adds a guest to a team. An invitation goes out. Until it's redeemed it is pending exposure — access granted but not yet activated. These unredeemed invitations are worth their own line in any audit: they are decisions waiting to become access.
- Redemption. The guest accepts and becomes a B2B account in your directory. From here their reach is whatever was shared — plus everything those grants extend to through inheritance.
- Sprawl. The active project adds them to a group here, a folder there. Group membership is the quiet multiplier: a guest in a Microsoft 365 group can reach the group's whole site.
- Abandonment. The project ends. The guest's employer may even have off-boarded them. Your tenant still lists the account, and every grant still works.
Why the directory view isn't the answer
The Entra admin center will happily list your guests — who exists. The audit question is what can each of them reach, and that's a different query entirely: it lives in SharePoint and OneDrive permissions, sharing links, group memberships, and inheritance chains, not in the user list. (Entra's built-in access reviews can put guest membership on a review cadence — a good control where licensing allows it — but they review membership, not the effective file-level reach.)
A review routine that gets done
- Quarterly, not annually. Guest sprawl compounds; a year of drift is a remediation project, a quarter is a checklist.
- Start from access, not identity. "Files reachable by external accounts" finds the problem directly — including access through groups and inheritance that a per-guest walk misses.
- Treat pending invitations as first-class. Un-redeemed for 90 days is a decision to withdraw, cheaply.
- Review causes. Remove the folder grant or the group membership, and the hundreds of items it exposed go with it.
This is the shape TRACER365 gives the job: every guest-reachable item across SharePoint and every OneDrive, pending invitations tracked as their own finding type, inherited access collapsed under its cause, and the whole thing re-scanned on a schedule so next quarter's review starts current instead of starting over.