Account Security Problems

How to Manage Unexpected External Guest Accounts in Microsoft 365

Maira Mehtab Sep 22, 2026 869 views

Question details

The user wants to identify and manage unfamiliar user accounts ending in #EXT#@tenant.onmicrosoft.com within their Microsoft 365 tenant.

Product: Microsoft 365
Device & OS: not provided
Scenario: Reviewing user directories and discovering unexpected external guest accounts.
Observed behavior: Accounts with the #EXT# suffix appear in the Microsoft 365 user list, indicating that external users have been invited to collaborate on tenant resources.

Before you start

Ensure you have Global Administrator or User Administrator privileges in your Microsoft 365 tenant before attempting to review or modify guest account settings.

Solution 1Recommended

Review and Remove Unauthorized Guest Users in Admin Center

Use the Microsoft 365 Admin Center to inspect the guest user list, review sign-in activities, and remove or restrict accounts that should no longer have access to your resources.

Guest accounts (indicated by the #EXT# suffix) are created automatically when external users are invited to Microsoft 365 resources like Teams, SharePoint, or OneDrive. Periodic reviews of these accounts are highly recommended to maintain account security.

Access the Admin Center

Navigate to Guest Users

In the left navigation pane, click on 'Users' to expand the menu, and then select 'Guest users'.

Review the Account List

Look for accounts formatted with #EXT#@tenant.onmicrosoft.com. Select individual accounts to review their group memberships, invitations, and recent sign-in activity to determine if they still require access.

Delete or Block Accounts

If an account is obsolete or unauthorized, select it and choose 'Delete a user' or 'Block sign-in'. Confirm the action to immediately revoke their access to your organization's resources.

Restricting Future Invitations: To prevent unexpected guest accounts in the future, you can restrict external collaboration settings in the Microsoft Entra admin center to limit who is allowed to invite external guests.

Free Microsoft Office alternative

Simplify Document Collaboration with WPS Office

Managing enterprise tenants, guest accounts, and complex licensing in Microsoft 365 can be overwhelming. If you need a straightforward, secure, and user-friendly office suite without the hassle of tenant administration, consider WPS Office. It provides powerful tools for individuals and teams looking for an efficient alternative.

1. Download the Installer: Visit the official WPS Office website and click the free download button for your operating system.
2. Install WPS Office: Run the downloaded installer file and follow the on-screen instructions to complete the setup.
3. Open Your Documents: Launch WPS Office and instantly open your existing Microsoft Word, Excel, or PowerPoint files without formatting loss.

Fully compatible with Microsoft Office formats (Word, Excel, PowerPoint) to ensure seamless file sharing.No complex tenant administration or guest account management needed for basic local sharing.Lightweight installation with an intuitive, familiar tabbed interface.Free to use with built-in PDF editing and comprehensive document creation features.

microsoft office alternative - wps office

Frequently Asked Questions

Why do guest accounts have #EXT# in their username?

The #EXT# suffix is automatically appended by Microsoft Entra ID (formerly Azure AD) to identify users who were invited from an external organization or external email provider to collaborate within your tenant.

Can I prevent employees from inviting external guests to Microsoft 365?

Yes. You can manage and restrict guest sharing capabilities by adjusting the External Collaboration Settings in the Microsoft Entra admin center, allowing you to define exactly who can send guest invitations.

Does deleting a guest account remove the files they uploaded?

No, deleting a guest account only removes their access to your tenant. Any files they previously uploaded or edited in your shared SharePoint sites or OneDrive folders will remain intact.

Is it safe to keep inactive guest accounts?

Leaving inactive guest accounts in your directory can pose a security risk. It is a best practice to regularly audit your guest users and remove access for individuals who no longer need it to prevent unauthorized access.

Microsoft Office Security Issues