Collaborating outside the organisation.
WHAT GUEST ACCESS PROVIDES
People outside your organisation using their own identity to access your resources.
WHY THAT IS BETTER THAN CREATING ACCOUNTS FOR THEM
They manage their own credentials, and access is revoked in one place.
WHAT TO CONFIGURE
Who may invite guests What guests can see in the directory Which organisations may collaborate with you
WHAT CROSS-ORGANISATION SETTINGS PROVIDE
Trusting another organisation's authentication, so guests need not repeat it.
WHAT TO RESTRICT
Guest ability to enumerate your users and groups.
WHY
It is unnecessary and reveals your organisation's structure.
WHAT TO APPLY TO GUESTS
Conditional access policies, as you would to members.
WHY
Guests reach your data, and frequently from unmanaged devices.
WHAT TO REVIEW
Guest accounts, periodically.
WHAT YOU WILL FIND
Guests from collaborations that ended years ago.
WHAT TO IMPLEMENT
Access reviews, requiring someone to confirm continued need.
WHAT TO DO ON EXPIRY
Remove access.
WHAT TO RECORD
Why each guest was invited, and by whom.
