Guests are Entra ID identities your organisation does not own — but the personal information those guests can access is still yours under the Privacy Act. That makes guest and external access hygiene a direct privacy obligation, not a Microsoft 365 housekeeping nicety. This how-to covers four controls that resolve most audit findings.
This is one of four operational spokes off the pillar guide Auditing Entra ID for the Australian Privacy Act. The free Entra ID & Identity Assessment measures these controls as Pillar 3.
The 2026 default change you might have missed
Microsoft tightened outbound cross-tenant access defaults in December 2025. The change applies to new tenants automatically; existing tenants retain whatever posture they were on. Microsoft Learn describes the surface: "Cross-tenant access settings give you granular control over how external Microsoft Entra organizations collaborate with you (inbound access) and how your users collaborate with external Microsoft Entra organizations (outbound access)." (learn.microsoft.com — cross-tenant-access-overview, accessed 23 May 2026).
If your tenant has never had its cross-tenant access settings reviewed, you are almost certainly running an older default — and it is more permissive than the current posture.
Control 1 — B2B invitation restriction
Default behaviour allows any user with the Guest Inviter role (every user by default) to invite anyone with an email address. For most Australian organisations this is too open.
Configuration (Entra admin centre → External Identities → External collaboration settings):
- Guest user access: Restricted (Guest users have limited access to properties and memberships of directory objects).
- Guest invite settings: Only users assigned to specific admin roles can invite guests.
- Collaboration restrictions: Allow invitations only to specified domains. Add your trusted partner domains explicitly.
If you have a long allow-list, capture the business owner of each domain so you can re-validate annually.
Control 2 — Cross-tenant access settings
Configure inbound and outbound access for trusted partner tenants explicitly. For all other external tenants, default-deny.
- Default inbound: Block external user and group access by default. Trusted partners are added as exceptions with explicit B2B collaboration allowed.
- Default outbound: Block your users from collaborating outbound by default. Trusted partner tenants are added as exceptions.
- Trust settings: For trusted partners, decide which Conditional Access requirements (MFA, compliant device) you accept from their tenant. Most Australian organisations accept MFA from a trusted partner; few accept compliant-device claims.
This single setting page closes the bulk of "guest from random tenant" findings.
Control 3 — Guest expiry and inactivity cleanup
ISM-1503 expects guest accounts to expire. Microsoft provides two mechanisms:
- Inactive guest cleanup via Microsoft Graph. Automated PowerShell or Logic App that disables guests with no sign-in in 90 days, then deletes after another 30.
- Lifecycle workflows. Entra ID Governance feature for organisations on Entra ID P2 / Microsoft Entra ID Governance SKU. Native, no scripting required.
Either approach is acceptable; lifecycle workflows are easier to audit because the activity is logged in Entra Identity Governance natively.
Control 4 — External sharing visibility
Two reports to schedule monthly:
- External sharing report in SharePoint admin centre. Lists sites with external sharing turned on and the sharing scope.
- Guest user report in Entra admin centre. Lists all guests, last sign-in, sponsor (if recorded), and groups membership.
Pair with SharePoint Advanced Management Restricted Content Discovery for sensitive sites so external users cannot index personal information.
Tenant-level external sharing posture
In SharePoint admin centre → Policies → Sharing:
- External sharing: Existing guests (the safest mode short of "Only people in your organisation").
- More external sharing settings: Limit external sharing by domain, enabled with allow-list.
- Default link type: People with existing access. Sharing links should be deliberate, not the default.
- Default link permission: View, not Edit.
These four settings prevent the "I sent a link to someone, they forwarded it, now an unauthorised party can read personal information" scenario that is responsible for a measurable share of NDB notifications.
Privacy Act mapping
- APP 6 (use and disclosure). External sharing of personal information must align with the primary purpose of collection or a related expected purpose. Restrict guest invitations to allow-listed partners.
- APP 11 (security of personal information). Reasonable steps to protect from unauthorised access. Guest expiry, access reviews, and external sharing reporting are the reasonable-steps evidence.
- NDB scheme. A guest with standing access to a SharePoint site holding personal information is a single compromised credential away from an eligible data breach.
Audit cadence
- Cross-tenant access settings: review annually and after any partner change.
- B2B invitation allow-list: review annually.
- Guest expiry policy: in place permanently, validated quarterly.
- External sharing reports: monthly review by Microsoft 365 administrator, quarterly review by privacy officer.
Bottom line
Four controls — B2B invitation restriction, cross-tenant access settings, guest expiry, external sharing reporting — cover the bulk of Australian Entra ID guest-access audit findings. The free Entra ID & Identity Assessment measures all four; the practitioner Identity and Access Review inspects them against your specific partner footprint.
Sources: Microsoft Learn — Cross-tenant access overview, External Identities, B2B collaboration (accessed 23 May 2026). ASD Information Security Manual November 2025 release — ISM-1503 (cyber.gov.au, accessed 23 May 2026). OAIC Notifiable Data Breaches scheme and Australian Privacy Principles 6 and 11 (oaic.gov.au, accessed 23 May 2026).
