"Give me a report of the external users in our SharePoint" sounds like it should be one click. It isn't: the SharePoint admin center has no built-in report of external users at site level. What exists is a handful of per-site routes — and even once you've stitched them together, you have a list of who, not a report of what each guest can reach. Both halves matter, so here is how to get each.
The native routes and where they stop
The admin center's closest offer is per site: open Active sites, select a site, and the Membership tab lists its owners, members, and visitors, with guests labelled. Accurate — for that one site. A tenant with 300 sites means 300 visits.
PowerShell scales the same idea: Get-SPOUser enumerates the users of a given site (guest accounts are recognisable by their #EXT# login names), and Get-SPOExternalUser pages through the external users the tenant knows about. Loop either over every site and you have your list.
| Route | What it lists | Tenant-wide? | Shows what a guest can reach? |
|---|---|---|---|
| Admin center Membership tab | One site's owners, members, visitors — guests labelled | No — per site, by hand | No |
Get-SPOUser | All users of one site, incl. #EXT# guest accounts | No — you loop over sites | No |
Get-SPOExternalUser | External users known to the tenant, in pages | Partly — paged, filterable per site | No |
All three share the same limits: they are per-site or paged, they are manual snapshots you must redo to stay current, and — the structural one — they list who. None of them tells you which files, folders, or sites a given guest can actually open.
From "who" to "what they can reach"
A guest list is not an exposure list. Two guests look identical on it while one can open a single stale folder and the other — through a Microsoft 365 group membership or an inherited grant on a parent folder — can reach an entire site. The report worth reviewing ties each external principal to the resources it can open, including the access that no item's sharing panel shows.
The report in one scan
TRACER365 builds exactly that report. One read-only scan enumerates every guest across all SharePoint sites and OneDrives and ties each one to what they can reach: direct grants on files and folders, access arriving through Microsoft 365 group membership, and inherited access from parent grants — each surfaced as a severity-ranked finding. Inherited duplicates collapse under the single grant that caused them (in our testing, roughly 91% of raw findings collapsed as duplicates), so the report stays reviewable instead of becoming a 50,000-row export. Scheduled scans keep it current; the app runs locally on Windows with verifiable read-only scopes.
For the wider audit question — what the Entra-side tools cover, and the four shapes guest access takes — see the companion guide: how to audit guest access in Microsoft 365.