Guest accounts age fast. The project ends, the partner changes, and external access stays behind.

Microsoft Entra ID, which many teams still call Azure AD, gives you enough signals to catch that drift early. A solid audit looks at activity, age, invitation history, membership, roles, and whether the guest still has a business reason to exist.

The best reviews mix the portal, logs, access reviews, and Microsoft Graph reporting. That keeps the process practical and defensible.

Build a guest-account checklist first

Start with the same questions for every account. That keeps the review fair and easy to explain later.

Check	What to look for	Why it matters	Typical action
Last sign-in	lastSignInDateTime and recent sign-in logs	Shows whether the guest still uses access	Disable or review if idle
Account age and invitation status	Created date, accepted invite, inviter in audit logs	Old or failed invites may be abandoned	Confirm owner or remove
Group and app membership	Security groups, Microsoft 365 groups, app assignments	Access often hides in memberships	Remove unneeded access
Privileged roles	Directory roles, PIM, admin assignments	Guest admins need extra scrutiny	Remove the role unless justified
MFA and Conditional Access	Sign-in logs, auth methods, CA policies	Guests should meet your control baseline	Enforce MFA or block access
Business owner and need	Ticket, app owner, resource owner	No owner means no accountability	Disable or delete after approval

If you can’t tie a guest to a current owner, treat that account as temporary until proven otherwise.

For a deeper look at Microsoft’s native reporting paths, see the B2B guest auditing guide. If you need to trace the inviter, finding who invited a guest user shows how audit logs expose that trail.

Review guest users in the Entra admin center

The portal is the fastest place to start. Open the Entra admin center, go to Users, filter on User type = Guest, then sort by last sign-in and created date.

Open each account and check the profile first. Look for the creation date, accepted invitation state, and whether the external email still matches the current partner or vendor contact.

Next, review Group memberships and Applications. Many guest access issues come from a single group that quietly grants more access than expected.

After that, inspect Roles and administrators. A guest with a privileged role deserves immediate attention, especially if the role was added for a short-term task.

Finish with Audit logs and Sign-in logs under Monitoring and health. Audit logs show invite and admin activity, while sign-in logs show whether the guest has used the account recently. Microsoft’s B2B collaboration reporting documentation maps these same checks.

A useful habit is to verify MFA and Conditional Access at the same time. If a guest can still reach sensitive data without the same controls you use for staff, the account needs a second look.

Use access reviews for ongoing governance

One-time cleanup helps, but it won’t keep the tenant clean for long. That is where access reviews come in.

Use Microsoft Entra ID Governance to review guest access to groups, apps, and entitlement packages on a schedule. Guests can review their own access, or owners can review it for them. For lower-risk collaboration, a 90-day cycle works well. For sensitive systems, shorten it.

In April 2026, guest governance features require a linked Azure subscription. Without that link, access reviews and related lifecycle features can be blocked. Microsoft’s access reviews for external users page explains the native flow.

Use the review result to take action. Keep the guest if the business owner confirms the need. Disable the account if access should pause. Delete the guest object when the account has no remaining purpose and your records are complete.

If your external access process is spread across emails, spreadsheets, and manual checks, Book a Discovery Call with Bud Consulting is a sensible next step.

Automate the report with Microsoft Graph PowerShell

Portal checks are fine for a few users. For a larger tenant, Graph reporting is faster and easier to repeat.

Microsoft Graph PowerShell can pull guest users, sign-in activity, and audit events into one export. Start with Get-MgUser -Filter "userType eq 'Guest'" -Property Id,DisplayName,CreatedDateTime,SignInActivity. Then review signInActivity.lastSignInDateTime against your inactivity rule.

You can also query sign-in and directory audit logs with Get-MgAuditLogSignIn and Get-MgAuditLogDirectoryAudit. That helps you confirm whether a guest signed in recently, accepted an invitation, or triggered a role change.

Microsoft’s inactive user account guidance explains how to use last sign-in data to find stale identities. That same approach works well for guest cleanup.

A simple reporting loop looks like this:

1. Export all guest users with account age and sign-in data.
2. Match each account to its group memberships and role assignments.
3. Flag guests with no sign-in for 90 days or more.
4. Confirm the business owner before you disable or delete anything.
5. Save the report so you can show what changed and why.

A final cleanup pass should remove stale group links first, then disable the guest, and finally delete the object when policy allows it. That order avoids leaving behind access paths.

Keep the guest list small

A good guest audit is not about counting users. It is about proving that every external account still has a job to do.

When you review last sign-in, account age, invitation status, membership, roles, and business need, the risk picture becomes clear. The portal gives you fast checks, access reviews keep governance alive, and Graph makes the work repeatable.

That is the real goal with Entra ID guest accounts, a tenant where external access stays useful without drifting into clutter.