How to list guest users in SharePoint Online

Before you start

Use an account with the SharePoint Administrator role. In PowerShell 7 the SharePoint Online Management Shell must be loaded through Windows PowerShell, which the last line of the install block does.

The list is read live. SharePoint gives at most 50 guests a call, so the script asks page by page until a page comes back short. The examples read and export and change nothing.

Option 1

List SharePoint guests with PowerShell

Install the module once, then connect and export every guest. The connection prompts you to sign in. Replace contoso with your tenant's name.

# Install once, if the module is not already installed.
Install-Module Microsoft.Online.SharePoint.PowerShell -Scope CurrentUser
# In PowerShell 7 only: load the module through Windows PowerShell.
Import-Module Microsoft.Online.SharePoint.PowerShell -UseWindowsPowerShell

$ErrorActionPreference = 'Stop'
Connect-SPOService -Url 'https://contoso-admin.sharepoint.com'
try {
    $guests = [System.Collections.Generic.List[object]]::new()
    $position = 0
    do {
        # SharePoint returns at most 50 guests a call.
        $page = @(Get-SPOExternalUser -Position $position -PageSize 50)
        foreach ($guest in $page) { $guests.Add($guest) }
        $position += $page.Count
    } while ($page.Count -eq 50)
    if ($guests.Count -eq 0) {
        Write-Output 'SharePoint lists no guests.'
    } else {
        $guests | Sort-Object WhenCreated |
            Select-Object DisplayName, Email, InvitedAs, AcceptedAs, InvitedBy, WhenCreated |
            Export-Csv -Path './sharepoint-guests.csv' -NoTypeInformation -Encoding utf8
        Write-Output "$($guests.Count) guests written to sharepoint-guests.csv."
    }
} finally {
    Disconnect-SPOService
}

The file lists the oldest guests first, which are often the ones to review. InvitedAs is the address the invitation went to and AcceptedAs the account the person signed in with; when they differ, the guest accepted with another account. To list only those, add -ShowOnlyUsersWithAcceptingAccountNotMatchInvitedAccount $true to the call. -Filter narrows to guests whose first name, last name or email address begins with the text you give.

List the guests of 1 site

Reconnect with Connect-SPOService, then read 1 site's guests. The main export above disconnects when it finishes.

# Run while connected to SharePoint. Replace the example address.
$site = 'https://contoso.sharepoint.com/sites/research'
$position = 0
do {
    $page = @(Get-SPOExternalUser -Position $position -PageSize 50 -SiteUrl $site)
    $page | Select-Object DisplayName, Email, AcceptedAs, InvitedBy
    $position += $page.Count
} while ($page.Count -eq 50)

Option 2

Review guests in the admin centre

1. Sign in to the Microsoft 365 admin centre for the correct tenant.
2. Expand Users and select Guest users.
3. Read the list. Guests added through Microsoft Teams, SharePoint or Microsoft Entra all appear here.
4. Leave the page without removing anyone: access can be removed from this list.

This suits a look at every guest in the directory. It holds more than the guests SharePoint knows about, so for SharePoint's own list with the invited and accepted addresses, use PowerShell or Altivane.

Common questions

Why do the invited and accepted addresses differ?

The guest accepted the invitation by signing in with a different account from the address it was sent to, such as a personal one. Microsoft's cmdlet lists just those guests with -ShowOnlyUsersWithAcceptingAccountNotMatchInvitedAccount $true, so you can check each is the person you meant to share with.

Why does the script read 50 guests at a time?

Microsoft says -PageSize must be 50 or less, and the cmdlet returns 1 page a call. The script moves -Position on by each page's count and asks again until a page holds fewer than 50.

How do I see every guest in the directory?

SharePoint's list holds the guests it knows about. For every guest account in Microsoft Entra ID, however it was added, see how to list guest users in Microsoft Entra ID.