What’s the Best Way to Manage Guest Accounts?
Guest account management should be a part of every Microsoft 365 tenant administrator’s checklist, unless the tenant has no guests. That’s possible but given the way that workloads like Teams and SharePoint Online create new guest accounts, the average tenant is likely to have quite a few guests. The question is how to manage guests – with Microsoft’s tools or using tenant-designed PowerShell scripts? https://office365itpros.com/2025/09/18/guest-account-management/
Guest accounts and groupchats
Hello everyone, I recently received a support request regarding adding a person with a guest account to a group chat. Unfortunately, Teams refused to add that account. Copilot explained that this is due to the restrictions guest accounts have when it comes to communicating within the tenant they are invited to. Apparently—and this is what I’d love for you to verify—guests are only able to communicate within channels (e.g., threads in a channel) and in 1:1 chats. After we deleted the guest account, we were able to add that person to the group chat. Are the following informations correct? Guest user in tenant: Added as a guest in your tenant’s Azure Active Directory Access: Teams channels, files, meetings Restriction: No regular group chats outside of Teams channels External user (federation): Remains in their own tenant, connected to yours through federation Access: Chats and calls like regular Teams users Advantage: Can be added to regular group chats Thank you for your help. Best Hisham
SPF, DKIM and DMARC bypassed for guest users
I manage a small non-profit using Microsoft 365 Business Basic. Most of the people on our board of directors are added as unlicensed guest users so that they can participate in Teams chats and meetings and to access our Sharepoint without using up a license. The problem: any email sent from an internal licensed user (or shared mailbox) to one of these guest users completely bypasses our domain's SPF, DKIM and DMARC configuration, resulting in bounced emails (particularly for recipients using gmail). Mail sent from an internal licensed user to any external address NOT registered as a guest user correctly passes SPF, DKIM and DMARC checks. I gather that this is because guest users are viewed as "internal" despite having external email addresses, but it seems like a serious limitation if I cannot reliably send email to anyone who is a guest user. Is there any extra configuration I can do to enable SPF, DKIM and DMARC for email to guest users?
Microsoft 365 Windows 11 external user or guest user sign in
Consider the following situation: CompanyA has a Microsoft 365 tenant with licensed users. CompanyA has a business relationship with CompanyB which also has a Microsoft 365 tenant. All of CompanyB's Windows 11 Pro computers are Entra ID joined and Intune enrolled. All of CompanyB's users have Microsoft 365 Business Premium licenses. An employee of CompanyA is stationed at CompanyB's office and needs to use one of CompanyB's computers as his primary computer. How would a technician have to configure things so that CompanyA user can sign into CompanyB's Windows 11 Pro computer and work like normal? I've done some reading online but most of the articles focus on access to cloud resources, whether that be Microsoft Teams or Entra Enterprise Apps or similar resources. I haven't found an article touching on Windows 11 sign in. MatthewRecommendation - Microsoft 365 authorisation concepts - Part 1
[New Blog Post] *PART 1!* I have put a new article online. This article is divided into two parts. In these two parts, you will learn the most important things about #AdministrativeUnits in #EntraID. What needs to be considered when creating an authorization concept. https://www.msb365.blog/?p=5495 #MVPsummit #M365 #Microsoft365 #CommunityRocksHow to Purge Guest Accounts with Unredeemed Invitations from Azure AD
It’s easy to invite people to become guest users in a Microsoft 365 tenant, but some of the invitees never accept the invitation. Perhaps they don’t need to redeem the invitation to do work or maybe it’s because they don’t want to. In either case, Azure AD guest accounts with unredeemed invitations can accumulate and become stale. In this post, we discuss how to use PowerShell to find and remove those stale accounts in a safe manner. https://office365itpros.com/2023/02/07/azure-ad-guest-accounts-unredeemed/Adding QR Codes to Microsoft Authenticator for Azure AD Guest Accounts
Getting a new device means that some work must be done to ensure that apps work. This article explains how to add QR codes to the Microsoft Authenticator app so that the app has the credentials to respond to MFA challenges. We cover how to get QR codes for Azure AD accounts and how to do the same for guest accounts in other Microsoft 365 tenants. https://office365itpros.com/2023/01/04/microsoft-authenticator-app-qr/
