How to Export the List of Guest Users in Microsoft 365

When managing guest users in Microsoft Entra ID, there may be instances when a guest user needs to be converted to a member of your organization. Specifically, when a trainee transitions from a guest user to a permanent employee, converting them to a member is essential. This ensures full access to organizational resources and internal systems.

Convert Azure B2B guest users to members using Entra portal

After converting the external user to internal user, manually update their attributes in Azure AD and assign the appropriate license to complete the migration.

Note: To convert an internal guest user to a member, simply change the 'User Type' attribute to Member using the Edit properties option available in the user profile within the Entra portal.

Convert guest users to members in Microsoft 365 using PowerShell

Connect to the Microsoft Graph PowerShell with the required permission using the cmdlet below.

Connect-MgGraph -Scopes "User.Read.All"

Run the following cmdlet to convert an external guest user to a member in Microsoft 365.

Update-MgUser -UserId <GuestUserUPN> -UserType Member -UserPrincipalName <NewUPN> -UsageLocation <UsageLocation>

Similarly, to convert an internal guest user to a member in Microsoft 365, skip the -UserPrincipalName parameter in the above cmdlet.

While guest users enhance collaboration between organizations, they can pose security risks if unauthorized users are invited and given access to resources. By regularly auditing guest user invitations, you can maintain control over external access and strengthen security within your environment. For instance, when an unexpected guest user appears, tracking the person who invited ensures accountability.

Find who invited a guest user in Microsoft Entra ID

• In the Microsoft Entra admin center, navigate to the Audit logs tab under Identity»Users»All Users.
• Click on the Activity filter and select Invite external user to view the guest user invitation in the past 30 days.
• Click on a specific log entry to view detailed information about the external user invitation.

Get the invitation state of an Azure AD guest user

• In the Entra admin center, locate the invited user and click on their account to view their profile.
• On the user profile's Overview page, you can check whether the invitation has been accepted under the B2B Invitation tile.

• Utilize the external user addition policy template to generate an alert when an external user is added to your organization.
• Click on Preview & Deploy to generate alerts separately for each external user addition.

Pro-tip: Set the Threshold property when creating the alert policy to get notified when a specific number of external user creations occurs within a short period.

Guest access in Microsoft 365 allows people outside your organization to access resources such as Teams, SharePoint sites, and more within your M365 environment. Configuring their access settings is crucial to ensure secure collaboration and prevent unauthorized access to sensitive information.

To manage guest access settings, navigate to Identity»External Identities»External collaboration settings in the Microsoft Entra admin center and adjust the options as needed.

Configure Guest User Access Permissions in Entra ID

This setting controls what information guests can see in your Microsoft Entra.

→ Guest users have the same access as members (most inclusive)

This option allows the guest users to have the same level of access to all directory information and Microsoft Entra resources as regular members.

→ Guest users have limited access to properties and memberships of directory objects (default setting)

This option restricts guest users from performing certain directory tasks, such as listing users, groups, or other resources. However, they can view the membership of all non-hidden groups.

→ Guest user access is restricted to properties and memberships of their own directory objects (most restrictive)

This option allows guest users to access only their own profiles while restricting them from viewing other users' profiles, groups, or group memberships.

Configure external user leaving settings in Entra ID

Toggle the “External user leave settings” option to Yes to allow external users to remove their accounts from your organization. Switching it to No disables this feature and prevents guests from removing themselves.

You can control how guest users are invited to your Microsoft 365 organization by configuring invitation settings in Entra ID. These settings allow you to restrict who can send invitations and specify allowed or blocked domains.

To manage guest user invite settings in Microsoft 365, navigate to the External collaboration settings page in the Entra admin center and adjust the following options as needed.

Configure guest invite settings in Entra ID

This section decides who has the authority to invite guests through SharePoint Online, Teams, and the Entra portal.

→ Anyone in the organization can invite guest users including guests and non-admins (most inclusive - default setting)

This setting allows your organization members, internal guests, and external guests to invite other guests to your organization.

→ Member users and users assigned to specific admin roles can invite guest users including guests with member permissions

This setting allows only regular members of your organization and guests assigned specific admin roles to send guest invitations.

→ Only users assigned to specific admin roles can invite guest users

This option allows only users with the User Administrator or Guest Inviter roles to invite guests to your organization.

→ No one in the organization can invite guest users including admins (most restrictive)

This setting completely disables the ability to invite guest users across the organization, even for administrators.

Configure external collaboration restrictions across domains

Under this section, you can manage B2B invitations across the domains with an allowlist or blocklist.

→ Allow invitations to be sent to any domain (most inclusive - default setting)

This setting enables unrestricted B2B collaboration, by allowing users in your organization to invite guests from any external domain without limitations.

→ Deny invitations to the specified domains

With this setting, guest user invitations to the specified domains are blocked.

→ Allow invitations only to the specified domains (most restrictive)

With this setting, invitations can only be sent to external users whose domains are explicitly listed in the allowlist.

Regularly reviewing and updating these settings ensures that your organization's collaboration with external users remains secure and aligns with your internal policies.

Guest users in Microsoft 365 provide a convenient way to collaborate with external partners, but by default they have some limitations. Understanding these restrictions is essential for effective management and secured collaboration.

The above listed are some of the common limitations for guest accounts. However, these restrictions can be addressed by configuring the appropriate settings.