How to Report Guest Accounts and Their Membership of Microsoft 365 Groups (and Teams)

A Proliferation of Guest User Accounts Within Tenants

Azure Active Directory Guest User Accounts are terrifically useful in terms of allowing people outside your Microsoft 365 tenant to access resources inside the tenant. Applications like Teams, SharePoint Online, Planner, and Outlook Groups use the Azure B2B Collaboration framework to create new guest accounts to share information, whether it’s the membership of a team or access to a shared document or folder.

All is good, except for the proliferation of guest accounts that can quickly accumulate inside a tenant. In short, a regular spring cleaning is needed to ensure that unwanted guests are ejected.

The Problem of Deciding When to Leave

As always, the problem is to decide when a guest account should be removed. Left by themselves, guest accounts will remain in the tenant directory because neither Office 365 nor Azure Active Directory include an automated method to clean up guests past their best-by date. One approach is to review guest accounts that are older than a certain age and look for evidence to indicate if they should be removed.

For example, you might decide that membership of multiple Microsoft 365 groups (aka Office 365 groups) is sufficient reason to keep guest accounts. The logic here is that these memberships give people access to Teams (conversations), Outlook Groups (conversations delivered via email), and Planner (group tasks). Therefore, if we write a script to scan for guest accounts older than x days and then check if these accounts are members of groups, we should have some evidence upon which to base a decision to remove or keep.

PowerShell Script to Highlight Stale Guest Users and their Group Membership

The script below does the following:

• Finds all guest accounts in the tenant.
• Checks each guest to discover its age based on the RefreshTokensValidFromDateTime attribute, which is updated when the guest account is created. The New-TimeSpan cmdlet calculates how many days have elapsed since Azure B2B Collaboration created the guest account in the tenant directory.
• If the guest account is older than 365 days, we look for its group membership by running the Get-Recipient cmdlet to check the account’s distinguished name (an old but still useful X.500 construct) against the membership of Microsoft 365 groups. If you want to check guest accounts older or younger than 365 days, update the $GuestAccountAge variable with the number of days to check for.
• Writes the discovered information out to an array.
• After all guest accounts are processed, writes the contents of the array to a CSV file.

Here’s the code. Remember that you might want to update the code to add error handling and do whatever testing is necessary before you run the script against your production tenant. You need to connect your PowerShell session to Exchange Online and Azure Active Directory before running the script.

# Script to find Guest User Accounts in an Office 365 Tenant that are older than 365 days and the groups they belong to
# Find guest accounts
$GuestAccountAge = 365 # Value used for guest age comparison. If you want this to be a different value (like 30 days), change this here.
$GuestUsers = Get-AzureADUser -All $true -Filter "UserType eq 'Guest'" | Sort DisplayName
$Today = (Get-Date); $StaleGuests = 0
$Report = [System.Collections.Generic.List[Object]]::new()
# Check each account and find those over 365 days old
ForEach ($Guest in $GuestUsers) {
   $AADAccountAge = ($Guest.RefreshTokensValidFromDateTime | New-TimeSpan).Days
   If ($AADAccountAge -gt $GuestAccountAge) {
      $StaleGuests++
      Write-Host "Processing" $Guest.DisplayName
      $i = 0; $GroupNames = $Null
      # Find what Microsoft 365 Groups the guest belongs to... if any
      $DN = (Get-Recipient -Identity $Guest.UserPrincipalName).DistinguishedName 
      $GuestGroups = (Get-Recipient -Filter "Members -eq '$Dn'" -RecipientTypeDetails GroupMailbox | Select DisplayName, ExternalDirectoryObjectId)
      If ($GuestGroups -ne $Null) {
         ForEach ($G in $GuestGroups) { 
           If ($i -eq 0) { $GroupNames = $G.DisplayName; $i++ }
         Else 
           {$GroupNames = $GroupNames + "; " + $G.DisplayName }
      }}
      $ReportLine = [PSCustomObject]@{
           UPN     = $Guest.UserPrincipalName
           Name    = $Guest.DisplayName
           Age     = $AADAccountAge
           Created = $Guest.RefreshTokensValidFromDateTime  
           Groups  = $GroupNames
           DN      = $DN}      
     $Report.Add($ReportLine) }
}
$Report | Sort Name | Export-CSV -NoTypeInformation c:\Temp\OldGuestAccounts.csv

The latest version of the script is available on GitHub.

The output CSV file is shown (somewhat obscured to protect the names of the guilty) in Figure 1. Any guest that isn’t a member of at least one Microsoft 365 group is a potential delete target. As you can see from the created column, it’s easy for old and stale guest accounts to linger on unless you clean them up from time to time.

Details of a more comprehensive report of membership of Microsoft 365 Groups including both tenant and guest members and summary details are explained in this article.

---

We have lots of other PowerShell examples of how to manage Azure Active Directory guest users and other Office 365 objects in the Office 365 for IT Pros eBook.