600 guest accounts, a quarterly attestation the licences may not support, and 15 guests holding site-collection admin
Proseware collaborates with 40 partner organisations. The tenant holds 600 guest accounts; 480 were created by business users under the default 'anyone in the organisation can invite guests' setting, 90 have not signed in for 13 months, and 15 hold SharePoint site-collection administrator on partner-facing sites. Partners need access to three Teams and two SharePoint sites, and a few need a temporary project workspace for 90 days. A new regulation requires quarterly attestation that each guest still needs access, evidence of who approved the original invitation, and removal within 24 hours when a partner leaves. Business units want self-service. Entra ID P2 is licensed for 50 IT and security staff only; no governance add-on is being purchased this year.
1. What can you enforce with today's licences, and where does the requirement outrun the licence? Be explicit about the gap.
Read the worked answer
Split the requirement into controls you own for free and controls that are licence-gated.
Available now (E3 plus Entra ID P1): guest invitation restrictions limiting inviters to a named group; Conditional Access requiring MFA for guests; SharePoint guest link expiry policies; cross-tenant access settings to allow or block specific partner tenants; the built-in guest sign-in activity report.
Licence-gated (Entra ID P2 or Entra ID Governance): access reviews and entitlement management access packages - which are also the only native way to give business units self-service with approval and expiry built in.
State the gap plainly: you hold 50 P2 seats, consumed by IT and security. Access reviews and access packages are P2/Governance capabilities whose entitlement sits with the reviewers and the identities under review, not with the administrator who creates the review. Confirm with your licensing desk whether guests under review need their own P2 before assuming they are covered - either way, a 600-guest quarterly review is outside today's entitlement.
Recommended for this year: automate attestation with Microsoft Graph (sign-in activity, creation date, inviter) into a Power Automate approval flow that names a sponsor, with decisions exported to SharePoint as evidence, and reuse the same script for removal. Buy Governance or P2 for the reviewers next cycle and migrate the identical process into access reviews - the workflow design should not change, only the engine.
2. Design the guest lifecycle from invitation to removal, including how the 24-hour removal commitment is actually met.
Read the worked answer
Invitation → access → attestation → removal, with a named human at every step.
- Invite. Restrict invitations to a 'Guest Inviters' group and switch off 'anyone in the organisation can invite'. Every invitation goes through a form or approval flow that records sponsor, partner, business reason, and expiry date. The sponsor record is what makes everything downstream enforceable - the guest's credentials are homed in the partner tenant, so you have no reliable technical signal when they leave their employer.
- Access. Grant through Teams and SharePoint group membership only, never through directory roles or site-collection admin. Where access packages are unavailable, mirror 90-day expiry with a calendar-driven workflow plus the SharePoint guest access expiry policy.
- Attestation. Quarterly, each sponsor gets a keep/remove decision per guest. Sponsors answer, not IT - IT has no way to know whether the partner engagement is still live.
- Removal, two tiers. Immediate when a sponsor or partner reports a leaver: the service desk runs a single script that disables the guest, revokes sessions, and strips group membership. Scheduled on expiry: disable first, notify the sponsor, delete after 30 days so a returning partner can be reinstated cheaply.
- Evidence. Every decision, approver, and timestamp lands in a log an auditor can read. That artefact is what the regulation is actually asking for; the access review is only the mechanism.
The 24-hour commitment lives or dies on the sponsor notification path, so describe it as a process control with an SLA in your regulatory response rather than pretending the technical control is real-time. Sign-in inactivity alone is not a leaver signal - the default 30/90/180-day cleanup recommendations are far too slow to satisfy 24 hours.
3. What do you do in the first week about the 15 guests with site-collection administrator and the 90 dormant accounts?
Read the worked answer
Week one is containment, not cleanup. Sequence matters: close the invite setting first, or business users will recreate what you delete the same afternoon.
The 15 site-collection administrators. Handle these first - it is a standing privilege-escalation path held by accounts you do not control.
- Export the SharePoint audit log for those sites and look for permission changes, external sharing, and site creation over the past 90 days. Assume compromise until the audit says otherwise.
- Remove the site-collection administrator assignment, then re-grant only what is needed as Contribute or Edit through a SharePoint group.
- Add a scheduled Graph report of any guest holding a SharePoint or directory role, alerting to the SOC. If a guest can be made site-collection admin once, it will happen again.
The 90 dormant accounts (13 months without sign-in). Do not mass-delete on day one.
- Run the guest inactivity report, then disable sign-in - reversible in minutes if a partner reappears.
- Notify the sponsor with a 14-day reclaim window, then delete. Deletion removes the guest object and memberships but leaves authored content, which is the point of staging it.
- Fix the cause simultaneously: invitation restrictions plus an expiry policy so the next 90 never accumulate.
Communicate the change: business units will experience the invite restriction as a loss of autonomy. Pair the announcement with the request form so the compliant path is also the fastest path.