Guest users are external user accounts that are allowed to use your Office 365 tenant’s resources. Guest users can have access to Microsoft Teams, SharePoint, Planner, Yammer, OneDrive, Microsoft 365 groups, etc.
How to add Guest Users to Office 365?
Guest users can be added to the Office 365 organization in multiple ways. In general,
- You can add guest users by inviting them to join Microsoft 365 groups, Microsoft teams.
- You can add guest users by sharing files/ folders to external users through SharePoint Online or OneDrive.
Guest users have #EXT# in their UPN . For example, Bob from contoso.com was added to fabrikam.com as a guest user. Then Bob has following UPN: Bob_contoso.com#EXTemail@example.com
How to get all guest users in an Office 365 tenant?
Since guest users can be created by admins, group owners. and end–users, it is necessary to identify guest user accounts in the organization. An admin can view guest users in the organization either through Microsoft 365 admin center or Azure AD admin center.
However, admin centers can’t show necessary attributes like Guest account creation time, account age, and who created the guest account, etc. Also, Microsoft has not provided any option to download the guest user report with membership for further analysis.
So, what is the best way to list all guest users in the Office 365 tenant? As usual, PowerShell is the best option.
Export Office 365 Guest Users Report with PowerShell
The PowerShell cmdlet ‘Get-AzureADUser’ is used to retrieve guest users in the tenant. To list all the guest accounts, run the following.
Get-AzureADUser -All $true -Filter "UserType -eq 'Guest'"
The result will give plenty of attributes that may unnecessary, and it will not show the guest users’ group membership info. To find guest users’ membership, you need to use the ‘Get-AzureADUSerMembership’ cmdlet.
To ease your work, we have created a PowerShell script to export Guest users along with their most required attributes.
Download Script: GuestUserReport.ps1
- The script can be executed with MFA enabled account too.
- Exports report results as a CSV file.
- Allows to use filter to get stale guest accounts.
- Allows to use filter to get recently created guest users.
- Automatically installs the Azure Active Directory module (if not installed already) upon your confirmation.
- The script is scheduler friendly. I.e., Credential can be passed as a parameter instead of saving inside the script.
Office 365 Guest User Report – Sample Output
The exported guest user and their membership report looks like the screenshot below:
The Guest user/External users report contains the following attributes:
- Guest User Name (I.e., Display name)
- User Principal Name
- Email Address
- Creation Time
- Account Age
- Creation Type
- Invitation Acceptance Status
- Group Membership
How to Export Azure AD Guest User Report?
Step 1: Download the script.
Step 2: Start Windows PowerShell as Administrator.
Step 3: To view all the guest users and their info, run the script as follows.
You can use the above syntax to execute the script with both MFA and non-MFA account.
More Use-cases of Office 365 Guest User Report:
The script supports advanced filtering params which, helps you to get the report as per your need.
Get Stale Guest User Account Report:
As an admin, it is a good approach to cleanup old guest users if they left the organization or not needed further. It will help to revoke the access given. Depending on your organization’s requirement, you can get the list of stale guest accounts based on the account creation time.
To get old guest accounts, run the script with –StaleGuests param, which will return guest accounts that are older than the given number of days.
./GuestUserReport.ps1 -StaleGuests 365
This will export Guest users that are older than a year (I.e., 365 days). By referring to this report, admins can remove the old guest accounts.
Recently Created Guest User Report:
Office 365 has not given any option to view who created the guest account. So, the admin needs to monitor the newly created guest accounts.
To view the newly created guest accounts, run the script with –RecentlyCreatedGuests param, which will return guest accounts that are created within the specified days.
./GuestUserReport.ps1 -RecentlyCreatedGuests 7
The above code will export all the guest users that are created in the past 7 days.
Schedule Azure Guest User Report to run Periodically:
As said earlier, this script is scheduler friendly. You can pass the credential as a parameter. So, it will not prompt for username and password during execution.
./GuestUserReport.ps1 -UserName firstname.lastname@example.org -Password XXX
You can use Windows Task Scheduler for PowerShell scheduled task.
I hope this blog will you manage and reporting guest accounts in your organization. If you have any queries, reach us through the comment section.