How to Restrict Guest Access in Microsoft Teams

Guest access in Microsoft Teams lets you invite people outside your organisation — clients, contractors, partners — into specific teams and channels. Useful, but if you don't manage it, you can end up with external people sitting in channels they shouldn't be in, long after the project is done.

Here's how to tighten it up.

Guest access vs external access

They're different things. Guest access invites someone into a specific team where they can see files, channels, and chat. They become a member of that team.

External access (federation) lets people in other organisations chat with your users directly in Teams, without joining a team. They can't see your files or channels.

You can enable one, both, or neither. For most businesses, guest access is useful but needs controls. External access is lower risk.

Controlling who can invite guests

By default, any team owner can invite guests. If you want to restrict this, go to the Teams admin center → Org-wide settings → Guest access.

You can also control it in Entra ID → External Identities → External collaboration settings. Here you can restrict guest invitations to specific admin roles only.

We recommend limiting guest invitations to team owners and admins. This prevents random team members from inviting external contacts without oversight.

What guests can and can't do

By default, guests can access channels, files, chat, and meetings in the teams they're invited to. They can't see your directory, other teams, or organisation-wide content.

You can further restrict what guests can do in the Teams admin center → Guest access. Options include:

• Disable making calls — stop guests from using Teams calling.

• Disable screen sharing — prevent guests from sharing their screen in meetings.

• Disable private chat between guests and team members.

• Restrict file sharing permissions — guests can view but not upload.

Review and clean up regularly

The biggest risk with guest access is old guests who shouldn't be there anymore. A contractor finishes a project but stays in the team for months.

In Entra ID → Users → Guest users, you can see all external users in your directory. Review this quarterly.

Set up Access Reviews (available on Premium plans) to automatically ask team owners to confirm whether each guest still needs access. This is the best way to keep it clean without manual effort.

We configure guest access policies as part of our M365 security setup. If you've got external users in your environment and you're not sure who has access to what, we can audit and tighten it up.