Guest Access

Configure guest access in Microsoft Teams to allow external users to join teams and access channels, files, and conversations. Guest access settings are part of the broader Teams policy framework and interact with Azure AD external collaboration settings.

Note: Teams policies are available with any Microsoft 365 license that includes Teams. Policy management via Graph API requires Directory.ReadWrite.All and TeamsPolicy.ReadWrite.All permissions.

Guest Permissions

Team-level settings control what guests can do within teams they are invited to:

Setting	Default	Description
Allow guests to create channels	Off	Guests can create new channels in the team
Allow guests to update channels	Off	Guests can modify channel settings
Allow guests to delete channels	Off	Guests can remove channels

Guest vs Member Capabilities

Capability	Member	Guest
Create/update channels	Yes (if allowed)	Configurable
Delete channels	Configurable	Configurable
Add/remove apps	Yes (if allowed)	No
Create/update/remove tabs	Yes (if allowed)	Limited
Create/update/remove connectors	Configurable	No
Access files	Full access	Allowed channels only
Participate in meetings	Full features	Full features

Mention Settings

Control how @mentions work in teams with guests:

Show @team option — Allow members to mention the entire team
Show @channel option — Allow members to mention an entire channel

Guest Lifecycle

Team owner invites guest by email address
Guest receives invitation and accepts
Guest account created in your Azure AD as a B2B user
Guest accesses authorized teams and channels
Periodic access reviews verify continued need
Remove guest when access is no longer required

Membership Management

Role	Capabilities	Limits
Owner	Full control: settings, members, channels, apps, delete team	Max 100 owners per team
Member	Participate in channels, add tabs/connectors (if allowed)	Max 25,000 members per team
Guest	Limited access: chat, calls, files in allowed channels	5 guests per licensed user

Dynamic Membership

Connect teams to Microsoft 365 Groups with dynamic membership rules. Members are automatically added or removed based on user attributes like department, location, or job title.


# Dynamic membership rule example
(user.department -eq "Engineering") and (user.country -eq "United States")

Best Practices

Policy Design

Use group-based assignment for scalability
Keep the global policy restrictive as a baseline
Document exceptions with business justification
Test policies in pilot groups before wide deployment
Use policy packages for common role types

Security Considerations

Restrict guest permissions to minimum necessary access
Enable periodic access reviews for all guest accounts
Block guest access for teams containing sensitive data
Review guest access policies quarterly
Monitor guest activity via audit logs

API Reference


# Create private channel with guest members
POST /teams/{team-id}/channels
{
  "displayName": "Leadership",
  "membershipType": "private",
  "members": [
    {
      "@odata.type": "#microsoft.graph.aadUserConversationMember",
      "roles": ["owner"],
      "user@odata.bind": "users/{user-id}"
    }
  ]
}

GET /api/teams/guest-access — Get guest access settings
PUT /api/teams/guest-access — Update guest access settings
GET /api/teams/guest-access/users — List guest users across teams