Guest User Access Review

Overview

Guest User Access Review is a scheduled compliance flow that runs once a month and audits every guest user in Azure Active Directory. It queries Microsoft Graph for the full guest user list, calculates how many days have passed since each guest last signed in, and categorizes accounts as active or inactive based on a 90-day threshold. Results are logged to a SharePoint list for an auditable trail, a summary report is emailed to IT admins, and an approval request is raised for each inactive guest so an admin can decide whether to disable the account via Graph API. The flow is designed to give security and compliance teams a low-maintenance, recurring control over external collaboration access.

Use Case

Many tenants accumulate guest users from one-off SharePoint shares, Teams invitations, and project collaborations — and most of those accounts stay active long after the project ends. This flow gives IT and security teams a monthly, automated checkpoint to surface stale guest accounts, document the review (for SOC 2, ISO 27001, or internal audit evidence), and route removals through a lightweight approval rather than a script that silently deletes accounts. Because every step is logged to SharePoint and emailed to admins, the review doubles as the compliance artifact auditors typically ask for.

The flow is ideal for teams that:

• IT and security teams that need recurring guest-access reviews for compliance (SOC 2, ISO 27001, internal audit).
• Tenants with a high volume of external collaborators via Teams and SharePoint sharing.
• Organizations that want approval-gated guest removal rather than silent deletion.
• Admins who want a single auditable SharePoint list as the system of record for guest reviews.

Flow Architecture

Environment Variables

Connectors & Connections

Note — All connections are referenced as solution connection references; the flow is portable between environments as long as a connection is mapped at import time.

Customization Guide

Almost every realistic variant of this flow can be implemented by changing environment variable values. A few cases require small edits inside the flow definition — those are called out explicitly below.

Tune the inactivity threshold

The 90-day window is a reasonable default for most tenants, but compliance-heavy environments may prefer 30 or 60 days. Update the flowlibs_GuestInactivityThresholdDays environment variable rather than editing the condition expression — this keeps the policy auditable and lets you change it without re-importing the solution.

Add team-owner verification

Before raising the removal approval, branch on whether the guest has membership in any Microsoft 365 group and route a 'do you still need this guest?' approval to that group's owner first. This avoids surprising business owners when a guest they rely on disappears.

Include access context in the report

Enrich each guest row with the Teams and SharePoint sites they currently have access to (via Graph /users/{id}/memberOf and /users/{id}/joinedTeams). The extra context helps admins decide whether removal is safe.

Track review completion for compliance

Add a 'Reviewed By' and 'Decision' column to the SharePoint list and update them when the approval response comes back. The list then becomes the evidence artifact auditors ask for in SOC 2 / ISO 27001 user-access reviews.

Soft-disable before delete

Instead of DELETE-ing the guest in the approved branch, PATCH accountEnabled to false and tag the account for hard-delete after a 30-day grace period. This gives you a window to recover if a removal turns out to be a mistake.

Key Expressions

The flow is intentionally light on Power Fx / WDL gymnastics — the heaviest expressions are the branch-name concatenation and the approval outcome check. They are listed below in the order they appear in the flow.

div(sub(ticks(utcNow()), ticks(coalesce(item()?['signInActivity']?['lastSignInDateTime'], item()?['createdDateTime']))), 864000000000)

greater(variables('daysSinceLastSignIn'), int(parameters('flowlibs_GuestInactivityThresholdDays')))

concat(parameters('flowlibs_GraphApiBaseUrl'), '/users?$filter=userType eq ''Guest''&$select=displayName,mail,signInActivity,createdDateTime')