How to enable guest access in Microsoft Teams

Enabling guest access in Microsoft Teams means turning on four things that sit in four admin centers: Entra's external collaboration settings (who may invite whom), the Microsoft 365 groups guest setting (whether groups — and therefore teams — may contain guests), the Teams guest access switch with its per-guest permissions, and SharePoint's sharing level (so the guest can open the files in the channel). Leave one off and invites silently fail, or succeed and then the guest cannot see anything.

Which of the five external-collaboration mechanisms fits which relationship — guests, external access, shared channels, sharing links, cross-tenant sync — is the subject of External collaboration in Microsoft 365, explained, with the Teams-specific design in Teams external collaboration patterns and external and guest access in Teams. This page is the switch-on.

Prerequisites

• Global Administrator or a combination of Teams Administrator, SharePoint Administrator, and a Groups/User Administrator (the Entra external collaboration page needs Global Administrator or Security Administrator in practice).
• A decision on who may invite: admins only, admins and members, or everyone including guests. Members and admins is the usual middle ground.
• A partner domain allow-list if the business wants one (most regulated organisations do), and the sensitivity-label plan for teams if container labels are in use — a label can override the group guest setting per team.
• A test partner mailbox you control outside the tenant (a personal Outlook.com or Gmail is fine for the test).

Steps

1. Entra: external collaboration settings

Entra admin center → External identities → External collaboration settings. Guest user access: Guest users have limited access to properties and memberships of directory objects (the default; the most restrictive option hides other users from guests, which breaks @mentions). Guest invite settings: Member users and users assigned to specific admin roles can invite (or Anyone in the organization). Enable guest self-service sign up: No. Collaboration restrictions: Allow invitations only to the specified domains with your allow-list, or Allow invitations to be sent to any domain if you accept that.

2. Microsoft 365 groups: allow guests

Microsoft 365 admin center → Settings → Org settings → Microsoft 365 Groups: tick Let group owners add people outside your organization to Microsoft 365 Groups as guests and Let guest group members access group content. With PowerShell the same is the AllowGuestsToAccessGroups and AllowGuestsToBeGroupOwner values in the group directory setting; leave guests as owners false.

3. Teams: guest access and permissions

Teams admin center → Users → Guest access: Allow guest access in Teams: On. Then the per-guest capabilities — typical choices: Make private calls on, Video on, Screen sharing entire screen, Meet now on, Edit and delete sent messages on, Chat on, Giphy and Stickers your call, Immersive reader on. These apply to all guests in all teams; per-team restriction is done with team settings or a sensitivity label.

The switch above is the only Teams-level guest toggle; the change can take up to 24 hours to propagate, though it is usually minutes.

4. SharePoint: sharing level

SharePoint admin center → Policies → Sharing: SharePoint at least New and existing guests (guests added to a team must be able to be added to the site). If a specific team's site is set to Only people in your organization, guests in that team will see channel conversations but not files — restricting site sharing explains the interaction.

5. Per-team control (optional)

To allow guests in most teams but not some: apply a sensitivity label with Groups & sites → External user access → off to the sensitive teams, or leave the tenant switch on and use Teams' Manage team → Settings → Guest permissions to stop guests creating channels. To flip the default the other way (guests off except for listed teams), leave Microsoft 365 groups guest setting off and use a label that allows guests on the specific teams.

Verify

• As a team owner, Add member with the test address: the invite email arrives, the guest redeems it, lands in the team, sees channel posts and opens a file in Files. If the file step fails, revisit step 4.
• Entra → Users → filter User type: Guest shows the new guest with Invitation accepted.
• Teams admin center → Users → Manage users lists the guest with Guest as the user type.
• Run the Teams external collaboration checks in the tenant audit checklist — the guest expiration (SharePoint) and access review (Entra) settings should be on so guests do not accumulate.

Roll back

Turning the Teams switch off disables guest sign-in to Teams tenant-wide (existing guests see an error) but does not remove the guest accounts, group memberships, or SharePoint access; turning it back on restores everything. Turning off the Microsoft 365 groups setting stops new guests being added but leaves existing memberships. Removing guests for good is a per-user action in Entra (Users → the guest → Delete) or a bulk cleanup driven by an access review.