By default in Microsoft Entra, all users in your organization, including B2B guests, can invite external users. Tighten that to specific roles, give guests limited directory visibility, and use domain allow or block lists. These external collaboration settings sit under External Identities in the Entra admin center.
Setting one: guest user access
This decides what guests can see in your directory. Three levels exist:
- Same access as members, the most inclusive.
- Limited access to properties and memberships of directory objects. This is the default. It blocks guests from tasks like enumerating users and groups, though they can see membership of non hidden groups.
- Restricted to their own directory objects, the most restrictive. Guests see only their own profile.
If you do not have a reason to widen it, choose limited or the most restrictive.
Setting two: who can invite
Four options:
- Anyone in the organization, including guests and non admins. Most inclusive.
- Member users and users in specific admin roles.
- Only users in specific admin roles, meaning User Administrator or Guest Inviter.
- No one, including admins. Most restrictive.
The default, as Microsoft documents it, is that everyone including guests can invite. Letting guests invite guests means your guest list can grow with no one in your company deciding it.
The Guest Inviter role is the useful middle path. You can give a few people, such as a partner manager, the ability to invite without giving them a broader admin role.
Setting three: allow or block domains
Collaboration restrictions let you allow or deny invitations to domains you list. For a company that works with a small set of partners, an allow list is simple and effective. For SharePoint, remember that with the B2B integration your Entra settings apply to sharing, and guest accounts are always created.
For other Entra organizations, also review cross tenant access settings so inbound and outbound collaboration is scoped to specific users, groups and apps.
Other settings
- Self service sign up via user flows, which lets guests create accounts for apps you build. Leave it off unless you use it.
- External user leave, which controls whether guests can remove themselves. This option is available only if you added privacy information to the tenant.
A baseline
- Guest access: limited, or most restrictive.
- Who can invite: admin roles plus Guest Inviter for named owners.
- Domains: allow list where possible.
- Quarterly review of guest accounts, removing anyone without a current project.
Sign in logs record B2B sign ins in both the home tenant and your tenant, which helps with review.
Quick check
Who can invite guests by default?
All users in the organization, including B2B guest users.
What is the Guest Inviter role for?
It lets a user invite guests without a higher privileged admin role, even when invitations are limited to admin roles.
Sources
Last reviewed: 19 October 2026.
