Sooner or later someone outside your organization needs to work inside one of your teams — a contractor, a partner, a client on a shared project. Microsoft Teams handles this with guest access, and it works well once it’s set up. The catch is that “set up” means flipping switches in two different admin portals, and a lot of people get stuck because they only find one of them.
This guide covers what guest access actually is (and how it differs from external access, which people constantly confuse it with), how to enable it properly across Microsoft Entra and the Teams admin center, how to add and manage a guest, and the security settings worth getting right before you start inviting people in.
Guest access vs external access — they’re not the same thing
These two features both involve people outside your organization, and Teams uses similar language for both, which is exactly why they get mixed up. They solve different problems.
Guest access brings an external person into a team. They get a guest account in your tenant (a Microsoft Entra External ID account), show up in the member list, and can participate in channels, chats, meetings, and files inside the teams they’re added to. This is for ongoing collaboration where an outsider is effectively part of the working group.
External access (also called federation) is for direct communication between organizations. It lets your users chat, call, and meet one-to-one with people in another domain without anyone being added to a team. The external person stays in their own tenant and never appears in your membership lists.
Guest access vs external access
| Goal | Add an outsider into your team |
|---|---|
| Account | Guest account created in your tenant |
| Scope | Full team: channels, files, meetings, chat |
| Best for | Contractors, partners on a shared project |
| Configured in | Entra + Teams admin (guest access) |
The rest of this guide is about guest access — adding people into your teams. If all you need is to chat with another company’s staff, you want external access instead, which is a separate toggle in the Teams admin center.
Enable guest access at the tenant level
Guest access is off-limits to team owners until an admin turns it on. There are two layers, and the order matters: get the Entra foundation right first, then the Teams switch.
Layer 1: Microsoft Entra external collaboration
Microsoft Entra is the identity layer underneath Teams, and it ultimately governs whether external people can be invited at all. In the Microsoft Entra admin center, go to Identity > External Identities > External collaboration settings and confirm:
- Guest invite settings allow the right people to invite guests (you can restrict invitations to admins and specific roles, or allow members to invite).
- Collaboration restrictions aren’t blocking the domains you need. You can allowlist or blocklist specific domains here.
This is also where Microsoft Entra External ID (formerly Azure AD External Identities / B2B collaboration) defines how guest accounts behave across your tenant — not just in Teams.
Layer 2: Teams admin center guest access
With the identity layer ready, switch to the Teams admin center > Users > Guest access. Set Allow guest access in Teams to On. Below that toggle you control what guests can do once they’re in — calling, meetings, and messaging permissions:
Teams guest access settings (per tenant)
| Make private calls | Whether guests can place 1:1 calls |
|---|---|
| Meeting features | Whether guests can use IP video, screen share, and Meet Now |
| Messaging — edit/delete sent messages | Whether guests can edit or delete their own messages |
| Chat | Whether guests can use chat in Teams |
Before you add your first guest
- Microsoft Entra external collaboration settings allow guest invitations
- Required external domains aren't blocked by collaboration restrictions
- Teams admin center > Guest access is set to On
- Guest calling, meeting, and messaging permissions are set the way you want
- You've waited for the tenant setting to propagate before testing
Add a guest to a team
Once the tenant settings are in place, adding a guest is something a team owner does directly, no admin portal required.
- In Teams, go to the team, click … > Add member.
- Type the guest’s full external email address (work, school, or even a consumer address like Gmail, depending on your settings).
- Teams shows an option to add them as a guest — select it. You can edit the display name shown to your team here.
- Click Add. The guest receives an email invitation with a link to access the team.
The guest accepts the invite, signs in (or creates a Microsoft account if they don’t have one tied to that address), and lands in the team. Inside, their name carries a (Guest) label so everyone can see they’re external — a small but useful signal during sensitive conversations.
Connect-MicrosoftTeams
# GroupId is the team's underlying Microsoft 365 group; the guest must already
# exist as a guest user in Entra, or be invited via the Entra B2B invitation API.
Add-TeamUser -GroupId "<team-group-id>" -User "[email protected]" -Role MemberWhat guests can and can’t do
Guests get a deliberately narrower experience than internal members. The exact capabilities depend on your tenant settings, but the general shape holds:
- Can: participate in channels they’re added to, post and reply, share and access files in those channels, join meetings, and (if allowed) chat and call.
- Can’t: browse the org’s directory freely, see teams they haven’t been added to, create teams, or take owner actions like managing members or deleting channels.
Per team, you control exposure mainly through structure. A guest only sees the channels they’re part of, so keep anything sensitive in a private channel the guest isn’t added to. Combined with the tenant-level guest permissions, that gives you two levers: what guests can do globally, and what any individual guest can see in a given team. For how those channel types work, see creating a team.
Security considerations worth getting right
Guest access is safe when it’s governed and risky when it’s forgotten. A few practices keep it from becoming a quiet hole in your perimeter.
- Restrict who can invite. Letting every member invite guests is convenient but hard to track. For tighter environments, limit invitations to owners or admins in the Entra external collaboration settings.
- Allowlist trusted domains. If you only collaborate with a known set of partners, use collaboration restrictions to allow just those domains and block the rest. That stops someone inviting a personal or unknown address by mistake.
- Apply Conditional Access to guests. Guests are external accounts hitting your data, so require MFA for them through a Conditional Access policy targeting guest/external users. Don’t assume the partner org enforces it.
- Review guests regularly. Projects end, people leave their companies, and guest accounts linger. Use Microsoft Entra access reviews to periodically make owners confirm each guest still needs access, and remove the ones who don’t.
- Watch what’s shared. A guest in a team can reach the files in their channels. Be deliberate about which channels they’re added to, and keep regulated or confidential material in channels they can’t see.
Remove a guest when access ends
When a project wraps, revoke access deliberately rather than leaving the account in place.
- Remove from the team. In the team, go to … > Manage team > Members, find the guest, and remove them. That cuts their access to that team immediately.
- Delete the account if it’s no longer needed. If the guest doesn’t need access to anything else in your tenant, delete the guest user in Microsoft Entra admin center > Users. Removing them from a team alone leaves the guest account active for other teams and resources.
For ongoing hygiene at scale, schedule access reviews so guests are re-validated on a cadence instead of relying on manual cleanup.
Wrapping up
Guest access is the right tool when an outsider needs to work inside your teams — just don’t confuse it with external access, which only enables cross-org chat and calls. The setup that trips people up is the two-layer enablement: Microsoft Entra external collaboration plus the Teams admin center toggle, both on, with time to propagate. After that, owners add guests with an email address, and the real work is governance: restrict who can invite, enforce MFA, and review guests so accounts don’t linger after the project ends.
Set the structure up well — clear teams, private channels for sensitive work — and guest access stays both useful and contained. For the foundation, see how to create a team, and browse more in the Microsoft Teams guides.
