SOLVED

How do you handle external users who have left the company?

%3CLINGO-SUB%20id%3D%22lingo-sub-1497296%22%20slang%3D%22en-US%22%3EHow%20do%20you%20handle%20external%20users%20who%20have%20left%20the%20company%3F%3C%2FLINGO-SUB%3E%3CLINGO-BODY%20id%3D%22lingo-body-1497296%22%20slang%3D%22en-US%22%3E%3CP%3EWhen%20you%20enable%20guest%20access%20in%20Teams%2C%20those%20users%20get%20brought%20into%20your%20Azure%20AD%20environment%2C%20but%20unlike%20your%20regular%20internal%20users%2C%20you%20have%20no%20way%20of%20knowing%20if%20those%20external%20users%20are%20still%20active%20or%20not.%20How%20do%20people%20typically%20handle%20this%3F%20Do%20you%20just%20monitor%20sign%20in%20activity%20maybe%20and%20disable%20accounts%20that%20had%20not%20logged%20in%20for%20a%20while%3F%20Do%20you%20require%20your%20external%20users%20to%20periodically%20response%20to%20an%20email%20saying%20that%20are%20still%20active%3F%20Maybe%20this%20not%20an%20issue%20people%20are%20typically%20concerned%20about%20so%20nothing%20needs%20to%20be%20done%3F%26nbsp%3B%3C%2FP%3E%3C%2FLINGO-BODY%3E%3CLINGO-LABS%20id%3D%22lingo-labs-1497296%22%20slang%3D%22en-US%22%3E%3CLINGO-LABEL%3EAdministrator%3C%2FLINGO-LABEL%3E%3CLINGO-LABEL%3EBest%20Practices%3C%2FLINGO-LABEL%3E%3CLINGO-LABEL%3EGuest%20Access%3C%2FLINGO-LABEL%3E%3CLINGO-LABEL%3EMicrosoft%20Teams%3C%2FLINGO-LABEL%3E%3C%2FLINGO-LABS%3E%3CLINGO-SUB%20id%3D%22lingo-sub-1497666%22%20slang%3D%22en-US%22%3ERe%3A%20How%20do%20you%20handle%20external%20users%20who%20have%20left%20the%20company%3F%3C%2FLINGO-SUB%3E%3CLINGO-BODY%20id%3D%22lingo-body-1497666%22%20slang%3D%22en-US%22%3E%3CP%3EAzure%20AD%20Access%20Reviews%2C%20Entitlement%20management%20if%20you%20have%20the%20licensing%2C%20or%20just%20periodically%20checking%20their%20activity%20via%20the%20Unified%20audit%20log.%3C%2FP%3E%3C%2FLINGO-BODY%3E%3CLINGO-SUB%20id%3D%22lingo-sub-1497767%22%20slang%3D%22en-US%22%3ERe%3A%20How%20do%20you%20handle%20external%20users%20who%20have%20left%20the%20company%3F%3C%2FLINGO-SUB%3E%3CLINGO-BODY%20id%3D%22lingo-body-1497767%22%20slang%3D%22en-US%22%3E%3CP%3E%3CA%20href%3D%22https%3A%2F%2Ftechcommunity.microsoft.com%2Ft5%2Fuser%2Fviewprofilepage%2Fuser-id%2F421392%22%20target%3D%22_blank%22%3E%40michaelkubala%3C%2FA%3E%26nbsp%3BFor%20us%20it%20is%20a%20joint%20responsibility.%26nbsp%3B%20The%20HR%20department%20are%20responsible%20for%20notifying%20the%20IT%20department%20of%20any%20staff%20who%20are%20leaving%20in%20advance%2C%20providing%20IT%20with%20a%20leaving%2Flast%20date%2C%20and%20if%20available%20the%20named%20person%20who%20will%20be%20taking%20over%20that%20persons%20role%20or%20position%20(Account).%26nbsp%3B%20We%20then%20schedule%20to%20a)%20change%20the%20password%20and%20b)%20forward%20incoming%20emails%20or%20allow%20shared%20access%20to%20that%20account%20either%20to%20check%2C%20or%20manage%20the%20account%20for%20an%20agreed%20period%20of%20time.%26nbsp%3B%20Once%20this%20time%20is%20up%2C%20the%20account%20is%20set%20to%20auto-reply%20for%20a%20further%20month%20before%20being%20archived.%26nbsp%3B%20Additionally%20any%20New%20starters%2C%20IT%20are%20again%20notified%20by%20the%20HR%20department%20in%20order%20to%20setup%20and%20prepare%20any%20accounts%20in%20good%20time.%3C%2FP%3E%3C%2FLINGO-BODY%3E%3CLINGO-SUB%20id%3D%22lingo-sub-1498711%22%20slang%3D%22en-US%22%3ERe%3A%20How%20do%20you%20handle%20external%20users%20who%20have%20left%20the%20company%3F%3C%2FLINGO-SUB%3E%3CLINGO-BODY%20id%3D%22lingo-body-1498711%22%20slang%3D%22en-US%22%3EThanks%20%3CA%20href%3D%22https%3A%2F%2Ftechcommunity.microsoft.com%2Ft5%2Fuser%2Fviewprofilepage%2Fuser-id%2F711937%22%20target%3D%22_blank%22%3E%40AlexWaterton%3C%2FA%3E%2C%20but%20I%20referring%20to%20guest%20users.%20For%20example%2C%20I%20work%20for%20company%20A%20and%20there%20are%20external%20users%20from%20company%20B%20in%20our%20Active%20Directory.%20Typically%20for%20internal%20employees%2C%20we%20have%20a%20system%20as%20you%20described%20for%20handling%20user%20accounts%2C%20but%20for%20our%20external%20users%20in%20company%20B%2C%20we%20wouldn't%20know%20that%20those%20employees%20are%20no%20longer%20with%20the%20company%20so%20those%20accounts%20would%20stick%20around%20forever%20in%20our%20system.%3C%2FLINGO-BODY%3E%3CLINGO-SUB%20id%3D%22lingo-sub-1498915%22%20slang%3D%22en-US%22%3ERe%3A%20How%20do%20you%20handle%20external%20users%20who%20have%20left%20the%20company%3F%3C%2FLINGO-SUB%3E%3CLINGO-BODY%20id%3D%22lingo-body-1498915%22%20slang%3D%22en-US%22%3EFor%20those%20users%20I%20would%20setup%20and%20automatic%20email%20to%20go%20out%20maybe%20every%203%20months%20to%20confirm%20user%20is%20still%20active%20and%20in%20post.%20If%20they%20do%20not%20reply%20then%20the%20account%20gets%20suspended%20within%2030%20days%20and%20archived%20after%2060%20days.%20Could%20well%20be%20just%20a%20Group%20Contacts%20setting%20that%20goes%20out%20quarterly%20in%20BCC%2C.%20Still%20may%20not%20be%20a%20full%20proof%20system%2C%20but%20may%20well%20result%20in%20a%20reduction%20of%20redundant%20accounts.%20Best%20of%20luck%20with%20whichever%20way%20you%20plan%20to%20attack%20the%20problem.%20%3A)%3C%2Fimg%3E%3C%2FLINGO-BODY%3E
Highlighted
Contributor

When you enable guest access in Teams, those users get brought into your Azure AD environment, but unlike your regular internal users, you have no way of knowing if those external users are still active or not. How do people typically handle this? Do you just monitor sign in activity maybe and disable accounts that had not logged in for a while? Do you require your external users to periodically response to an email saying that are still active? Maybe this not an issue people are typically concerned about so nothing needs to be done? 

4 Replies
Highlighted
Best Response confirmed by michaelkubala (Contributor)
Solution

Azure AD Access Reviews, Entitlement management if you have the licensing, or just periodically checking their activity via the Unified audit log.

Highlighted

@michaelkubala For us it is a joint responsibility.  The HR department are responsible for notifying the IT department of any staff who are leaving in advance, providing IT with a leaving/last date, and if available the named person who will be taking over that persons role or position (Account).  We then schedule to a) change the password and b) forward incoming emails or allow shared access to that account either to check, or manage the account for an agreed period of time.  Once this time is up, the account is set to auto-reply for a further month before being archived.  Additionally any New starters, IT are again notified by the HR department in order to setup and prepare any accounts in good time.

Highlighted
Thanks @AlexWaterton, but I referring to guest users. For example, I work for company A and there are external users from company B in our Active Directory. Typically for internal employees, we have a system as you described for handling user accounts, but for our external users in company B, we wouldn't know that those employees are no longer with the company so those accounts would stick around forever in our system.
Highlighted
For those users I would setup and automatic email to go out maybe every 3 months to confirm user is still active and in post. If they do not reply then the account gets suspended within 30 days and archived after 60 days. Could well be just a Group Contacts setting that goes out quarterly in BCC,. Still may not be a full proof system, but may well result in a reduction of redundant accounts. Best of luck with whichever way you plan to attack the problem. :)