Guest accounts, external identities invited for collaboration, become group members like anyone else, and from that moment they inherit whatever those groups grant, including transitively through nesting. The governance question is not whether guests exist but where they sit in the structure.
How guests end up with surprising access#
Guests are invited into a project team; the team's group is nested somewhere organizational; the organizational group carries grants nobody associated with external sharing. No single step was wrong, and the sum is an external identity with internal reach that no review approved as such.
The review that matters#
Per-guest membership lists answer the wrong question. The right one is structural: which groups containing guests, directly or through nesting, also carry access or license grants, and through which chains. That intersection is the actual external exposure.
Connect-MgGraph -Scopes "User.Read.All"
# All guest accounts
Get-MgUser -All -Filter "userType eq 'Guest'" -Property displayName,id |
Select-Object DisplayName, IdVisualizerEngine
How VisualizerEngine helps
The graph shows every path from a guest to whatever their memberships reach, structural search intersects guest membership with granting hierarchies, and saved searches keep the external-exposure review continuous. Snapshots document the guest posture at each review date.