Guest Access Reviewer

Guest Access Reviewer

Purpose

External collaborators accumulate on SharePoint sites over time — vendors, contractors, and clients who finished their engagement but were never removed. This skill enumerates every guest and external user who has access to the current SharePoint site, maps the groups and permission levels they hold, flags accounts that appear stale (no activity in 90+ days), and saves a self-contained HTML report that site owners and governance teams can act on. It is strictly read-only: it never removes users, modifies permissions, or changes any site content.

Trigger Phrases

Activate this skill when the user says any of the following (or close variations):

• "guest access review" / "guest access audit"
• "audit external users" / "external user audit"
• "who has guest access" / "which guests have access"
• "review external sharing" / "external access review"
• "find stale guests" / "stale external users"
• "who are the external collaborators on this site"
• "check guest accounts"

Inputs & Scope

Determine the scope from the user's request:

• Current site (default) — audit all guest users who have access to the current SharePoint site through any mechanism: SharePoint groups, direct role assignments, or sharing links.
• Named site — if the user names a specific site, resolve that site and audit it instead.

If no scope can be resolved, default to the current site and note that assumption in the report. Do not scan multiple sites unless the user explicitly asks.

What counts as a guest or external user

Identify the following as guest or external users:

• Accounts whose User Principal Name (UPN) contains #EXT# — the standard Azure AD guest account marker
• Accounts in the _spo_ guest account format used by SharePoint sharing
• Accounts with an email domain that differs from the host organization's primary domain(s) when this can be determined from context
• Users explicitly shown as "Guest" in SharePoint user information

Do not flag internal service accounts, system accounts, or Microsoft application identities as guests.

Steps

Step 1 — Resolve the site

Resolve the current SharePoint site URL. Record the site title, URL, and the exact date and time of the audit. Confirm read access to site user and permission data before proceeding.

Step 2 — Enumerate all users with access

Collect every user who has any form of access to the site:

• Members of all SharePoint groups (Owners, Members, Visitors, and any custom permission groups)
• Users with direct permission grants not through a group
• Users visible in the site's user information list

For each user record, capture:

• Display name
• Login name / UPN
• Email address
• Whether the account appears to be a guest or external identity
• SharePoint group membership (all groups they belong to)
• Effective permission level (Owner / Edit / Read or equivalent custom level)

Step 3 — Identify and profile each guest user

From the full user list, isolate the guest and external accounts using the criteria in What counts as a guest or external user.

For each guest, collect:

• Display name
• UPN / login name
• Email address
• External organization domain (derived from email)
• All SharePoint groups they belong to
• Effective permission level on the site
• Last activity or last modified date (from SharePoint user information or site audit logs, where available)
• Invited by (if determinable from SharePoint sharing records)

If a field cannot be determined, record it as "Not available" — do not omit it or invent a value.

Step 4 — Classify each guest's status

Assign one of three statuses to each guest account:

Assign a recommended action for each:

• Active → No immediate action; note for periodic review
• Stale → Recommend reviewing with site owner; consider removing access
• Unknown → Recommend confirming with site owner whether the guest is still an active collaborator

Do not classify a guest as Stale based solely on the absence of activity data — that is Unknown, not Stale.

Step 5 — Summarize findings

Calculate the following metrics:

• Total users with site access
• Total guest / external users
• Guests by permission level (Owner / Edit / Read)
• Active guests
• Stale guests (90+ days)
• Unknown-status guests
• Number of unique external domains represented
• Top external domains by guest count