ENTRALOGIC
← Back to insights

Enterprise IT · 19 August 2026 · 5 min

The default setting is that anyone can invite

Guest access, cross-tenant access, and the gap with no expiry date

A concrete question to bring to the next management meeting: who in our organization can invite an external person into our Teams environment?

The statistically most likely answer is "everyone" — including the external people who have already been invited in. Not because anyone decided it, but because it is the default setting, and because nobody has changed it.

The default values

allowInvitesFrom in authorizationPolicy has the default value `everyone` in every cloud environment except US Government. The portal's own description of the option: "Anyone in the organization can invite guest users including guests and non-admins (most inclusive)."

The three alternatives are:

  • adminsGuestInvitersAndAllMembers — member users and selected administrator roles
  • adminsAndGuestInviters — only Global Administrator, User Administrator and Guest Inviter
  • none — nobody, not even administrators

Cross-tenant access settings have correspondingly open defaults: B2B collaboration inbound is allowed, outbound is allowed, no organizations are preconfigured, and no external MFA or device claims are trusted. B2B direct connect, by contrast, is blocked by default, and cross-tenant synchronization is not enabled.

License note: basic cross-tenant access settings are free. Trust settings — trusting external MFA or device state — require P1. Scoping the settings to specific users, groups or applications also requires P1. B2B direct connect requires P1 in both tenants.

The guest account has no expiry date

This is the core of it. There is no built-in expiry mechanism on guest accounts in Entra ID. Invite a consultant in January 2023 for a six-week project, and the account is still sitting there in August 2026 unless somebody actively removed it.

Microsoft's answer to this is access reviews — periodic reviews, not real expiry. What it takes to get automatic removal:

  • License: Entra ID P2 or Entra ID Governance.
  • "Auto apply results to resource" must be on.
  • "If reviewers don't respond" must be set to "Remove access" — otherwise nothing happens when nobody responds, which is the most common outcome.
  • For removal from the tenant itself: "Action to apply on denied guest users" → "Block from signing in for 30 days then remove user from the tenant".

The license count is worth noting: both those being reviewed and those doing the reviewing must be licensed. Microsoft's own examples: a group with 75 members and one group owner as reviewer requires 76 licenses; 500 members and three reviewers requires 503. Guests are, admittedly, billed separately under the MAU model, which presupposes an Azure subscription with guest billing enabled.

What the guest actually sees

The default access level for guests is "Guest users have limited access to properties and memberships of directory objects" (role ID 10dae51f-b6af-4016-8d66-8c2a99b929b3). The guest cannot enumerate users and groups freely — but can see memberships in all non-hidden groups. The stricter alternative, "Restricted Guest User" (2af84b1e-32c8-42b7-82bc-daa82404023b), is not the default.

Add to that the fact that the guest user authenticates against their own identity provider. If the consultant leaves the consulting firm, it is the consulting firm's IT that decides whether that person can still sign in — with you. You have no control over that part of the chain, only over whether the object exists in your directory.

And as covered in the article on offboarding: the guest object survives the departure of the employee who invited them. The Sponsor attribute points to whoever issued the invitation, but it is a tracking property — not an access dependency.

The supply chain is now explicitly regulated

For organizations in the seven sectors covered by the Norwegian Digital Security Act (digitalsikkerhetsloven) — energy, transport, health, water supply, banking, financial market infrastructure and digital infrastructure — this is no longer an internal housekeeping question. Section 12 of the Digital Security Regulations (digitalsikkerhetsforskriften), in force since 1 October 2025, expressly covers «leverandører og oppdragstakere» [Unofficial translation: "suppliers and contractors"], and requires the organization to «følge[r] opp at personell ikke har flere tilganger enn nødvendig» [Unofficial translation: "follow up that personnel do not have more access rights than necessary"], and that «den som slutter ikke lenger har tilgang» [Unofficial translation: "a person who leaves no longer has access"].

In the EU, NIS2 points the same way — article 21(2)(d) requires "supply chain security, including security-related aspects concerning the relationships between each entity and its direct suppliers or service providers", and article 21(2)(i) requires "human resources security, access control policies and asset management". As of August 2026 NIS2 has not been incorporated into the EEA Agreement and does not apply as Norwegian law — but Norwegian companies delivering into EU value chains meet the requirements through their customers' contracts regardless.

For financial entities, by contrast, DORA is already Norwegian law (in force 1 July 2025, supervised by the Financial Supervisory Authority of Norway (Finanstilsynet), fines of up to NOK 50 million). Article 9(4)(c) requires policies that limit access "to what is required for legitimate and approved functions and activities only", with controls that "address access rights and ensure a sound administration thereof".

What this means for Entra Logic

Guest access is the area where the gap between "we have a policy" and "the policy is enforced" is widest, because the invitation happens in the moment, by someone in a hurry, without triggering any review.

Entra Logic moves the invitation into the same order flow as every other change — a single order, a request that carries its own approval and execution: request–approve–execute, one audit trail. The continuous synchronization means that guest accounts with no activity, with no sponsor, or with a sponsor who has themselves left, show up as a concrete work list — not as a finding in the next audit.

Two clarifications, since the market confuses this: Entra Logic does not run periodic attestation or recertification campaigns, and does not replace Microsoft's access reviews as a formal review mechanism. What it does is ensure that every single guest came in through an approved, traceable decision — and that the list of those who no longer have any reason to be there is visible all the time instead of once a quarter.

—

Sources

RELEVANT SOLUTION

See how this is handled in practice:

For groups and multi-company organisations →Start free

Norwegian version: Les artikkelen på norsk

Related reading