Automatically Expire Guest and Contractor Access in Entra

Automatically expiring guest and contractor access in Microsoft Entra helps prevent external accounts from retaining access after a project or engagement ends. You can review guest access on a recurring schedule, require sponsors to confirm it is still needed, and configure access reviews to remove access when reviewers do not approve it. Before starting, confirm that your organization’s Entra licensing supports the review features you plan to use and decide who will review each group or application.

What You’ll Need

An account with permission to create and manage access reviews and, if needed, configure identity governance. Exact roles depend on your tenant’s configuration; use an appropriately authorized administrator.
A list of guest and contractor accounts, the groups or applications that grant them access, and a business owner or sponsor for each.
Microsoft Entra ID Governance or another eligible license for the access review capabilities you intend to use. Check current licensing and feature availability in Microsoft’s documentation before rollout.
A process for exceptions, such as a contractor whose engagement is extended, and a way for reviewers to identify the correct person and access.

Step-by-Step

Choose the access that must expire. Inventory external users and the resources they can reach. Include group memberships, application assignments, and direct access where applicable. Access reviews cover the selected scope; a review of one group does not automatically review every permission held by its members. Start with high-impact groups and applications, then expand.
Decide how expiration will work. An access review is a periodic decision process, not necessarily an exact end date for an individual account. Decide how often reviews run, how long reviewers have to respond, what happens when nobody responds, and who receives reminders. For a firm engagement end date, record that date in your onboarding or identity-management process and arrange account disablement or removal when it arrives. Do not treat a review schedule as a substitute for a known contract end date.
Open the access review area. Sign in to the Microsoft Entra admin center with an authorized account. Open Identity governance, then Access reviews. Microsoft may change portal labels; if the navigation differs, use the admin center’s search for “Access reviews” and verify that you are in the Microsoft Entra tenant intended for the change.
Create a review. Select New access review. Choose the resource type and scope you identified, such as a group or application. Give the review a clear name that states the population and purpose, for example, “External project access — quarterly.” Set the start date, recurrence, and review duration. Use a schedule that gives reviewers enough time without leaving decisions pending unnecessarily.
Set the reviewers. Choose people who can verify whether access is still required. Depending on the review type and available options, reviewers may include group or application owners, selected users, or the users’ sponsors. A sponsor is the internal person accountable for the external relationship. Avoid assigning every review to an unattended mailbox or to someone who cannot assess business need.
Configure decisions and nonresponses. Where the setup offers an option for reviewers to provide a reason, enable it to make decisions easier to audit. Set the outcome for users who are not approved, and decide what should happen when a reviewer does not respond. If the option is available, choose an appropriate action such as removing access, and configure automatic application of results only after testing. Be deliberate: an incorrect scope or default can remove access people still need.
Review guest-specific settings. If the review includes external users, check options for guest users and their sponsors. Some review configurations can use the guest’s sponsor as reviewer or apply a defined result when a sponsor is missing. Confirm that sponsors are populated and current; otherwise, reviews may have no useful decision-maker. Do not assume every guest is a contractor or that every contractor account is marked as a guest.
Check the configuration and start it. Review the scope, reviewers, recurrence, end date, decision rules, and automatic-application setting on the summary page. Save or start the review. If you are unsure about the effect of automatic removal, first run a pilot with a small, low-risk group and examine the results before enabling automation broadly.
Monitor results and verify removal. Return to Access reviews to check progress, reviewer decisions, and completed outcomes. Confirm that approved users retain the intended access and that denied or unreviewed users lose the access covered by the review. Check group membership or application access as appropriate. Removing a user from one group may not remove other assignments or disable the account itself.
Handle end dates and exceptions. When a contract ends or an extension is approved, update the account’s status and access through your established offboarding process. Review any other groups, app assignments, or permissions the person has. Keep an auditable record of extensions and exceptions, including who approved them and when access should be reviewed again.

Common Mistakes

Reviewing only one access path: A user may have direct application access or membership in another group. Inventory permissions and create reviews for each relevant scope.
Assuming a review is an account expiration date: Recurring reviews ask for decisions at intervals. They do not automatically know a contract’s actual end date unless you connect them to a separate lifecycle process.
Leaving “no response” harmless by default: If silence leaves access unchanged, inactive reviewers can allow access to persist. Choose a suitable nonresponse outcome and test its impact.
Using the wrong reviewer: A generic owner or outdated sponsor may not know whether access is needed. Assign accountable reviewers and maintain sponsor details.
Turning on automatic application too soon: A scope mistake can cause unwanted access removal. Pilot the review, inspect decisions, and communicate the process before broad deployment.

Tips

Use consistent review names and document scope, owner, frequency, and exception handling.
Set recurring reviews based on how quickly access needs change; high-risk access may warrant more frequent attention than stable, low-risk access.
Ask reviewers to confirm a specific business reason and expected end date, rather than simply recognizing a person’s name.
Test with a limited group and tell contractors’ sponsors what notifications and deadlines to expect.
Pair reviews with joiner, mover, and leaver processes. Disable accounts promptly when an engagement ends, then remove remaining assignments according to your organization’s retention and access policies.

Troubleshooting

Access reviews is missing: Check that you are in the correct tenant and have an appropriate administrative role. Confirm licensing and feature availability for your tenant; menu visibility and capabilities can depend on both.

Reviewers do not receive or see a review: Verify the configured reviewer identities, the review’s status and dates, and notification settings. Ask reviewers to open the Entra admin center directly and check the review list. Confirm that a guest’s sponsor is present if the review relies on sponsors.

A user remains active after a denial: Check whether results were applied, whether automatic application was enabled, and what resource the review covered. Then inspect other group memberships, direct assignments, and access paths. A review may remove the selected membership without disabling the user account.

People lose access unexpectedly: Pause or adjust the review if possible, investigate its scope and nonresponse settings, and restore only access that has been verified as necessary. Check the review’s decision history and audit records, then correct the configuration before restarting automation.

Contractor access has not ended on the expected date: Verify the end-date workflow separately from the review recurrence. Check account status and all assigned access; a periodic review may not coincide with the contract end date. Escalate through your organization’s approved offboarding process.

Frequently Asked Questions

Does an access review automatically expire a guest account?
Not by itself in every configuration. It can apply review results to remove access in the selected scope. Account disablement or deletion may require a separate lifecycle or offboarding action.

Can I set an exact expiration date for a contractor?
Use your organization’s account lifecycle or identity-management process for a firm end date. Access reviews are useful for periodic confirmation, but should not replace an end-date workflow.

Can a guest’s sponsor review access?
Some review configurations support sponsors as reviewers. Confirm that the sponsor is recorded, current, and able to make the decision for the selected resource.

What happens if nobody completes the review?
The outcome depends on the review’s nonresponse settings and whether results are automatically applied. Check these settings before starting and test them with a limited scope.

Will removing someone from a group disable their account?
No. It can remove access granted through that group, but the account and other permissions may remain. Verify each relevant assignment and follow your account offboarding process.

Do I need a special license?
Some access-review and identity-governance features require specific licensing. Check current Microsoft licensing documentation and your tenant’s entitlements before configuring the workflow.

General steps for current mainstream versions; menus can differ by device and version. See the disclaimer or report an error.

More in this bed

The whole Tech How-To bed →