iTechGuides is reader-supported. When you buy through links on our site, we may earn an affiliate commission. As an Amazon Associate I earn from qualifying purchases. Learn more
Use a Microsoft Entra entitlement-management access package to give each guest or contractor a defined end date. Set the package assignment to expire On date for a known project deadline, or after a specified number of days when access starts at different times. When the assignment expires, access granted through that package ends. Add recurring Access Reviews to verify continued need, remove access when reviewers deny it or do not respond, and optionally block the guest for 30 days before deleting the account.
This combination handles both planned offboarding and access that outlives its business purpose. It also avoids a common mistake: SharePoint guest expiration controls a credential, not the guest’s entire Microsoft Entra account.
Which setting should you use?
There are two complementary controls. An access-package expiration is a time limit attached to a defined bundle of resources. A recurring Access Review asks whether a guest still needs access and can automate removal when the answer is no, when a reviewer denies access, or when nobody responds.
| Control | Primary trigger | Scope | Automated result | Best use |
|---|---|---|---|---|
| Access-package assignment expiration | Fixed end date or duration | One package and its associated resources | Package-associated access is removed when the assignment expires | Project or contract with a known term |
| Recurring Access Review | Inactivity, reviewer decision, or no response | A selected group, application, package, or defined set of guests | Remove access; optionally block sign-in for 30 days, then delete the guest | Ongoing attestation and stale-user cleanup |
| SharePoint guest expiration | Credential expiration for a SharePoint guest | SharePoint guest sharing credential | Credential access expires; it does not by itself disable or remove the directory account | SharePoint sharing hygiene, not complete offboarding |
Use both controls when the access is important: let the package enforce the planned end date and let a review detect exceptions, inactivity, or access granted elsewhere.
#1 Best Overall
- POWERFUL SECURITY KEY: The Security Key C NFC is the essential physical passkey for protecting your digital life from phishing attacks. It ensures only you can access your accounts.
- WORKS WITH 1000+ ACCOUNTS: Compatible with Google, Microsoft, and Apple. A single Security Key C NFC secures 100 of your favorite accounts, including email, password managers, and more.
- FAST & CONVENIENT LOGIN: Plug in your Security Key C NFC via USB-C and tap it, or tap it against your phone (NFC) to authenticate. No batteries, no internet connection, and no extra fees required.
- TRUSTED PASSKEY TECHNOLOGY: Uses the latest passkey standards (FIDO2/WebAuthn & FIDO U2F) but does not support One-Time Passwords. For complex needs, check out the YubiKey 5 Series.
- BUILT TO LAST: Made from tough, waterproof, and crush-resistant materials. Manufactured in Sweden and programmed in the USA with the highest security standards.
How access-package expiration works
An access package represents a resource bundle, such as a project group, SharePoint site, application, or Teams-connected workspace. The package defines who may request access, which approvals are required, who reviews it, and how long an assignment lasts. Microsoft describes entitlement management as automating access requests, assignments, reviews, and expiration.
Expiration applies only to that assignment
When the assignment reaches its end date, Entra removes access delivered by that package. It does not prove that every permission held by the person has disappeared. A guest can still have another package assignment, a direct group or application assignment, a role assignment, or a separate sharing link. Investigate all paths to the resource before treating the person as fully offboarded.
Choose a date or a duration
- On date: Choose this when the project, statement of work, or contract has a definite end date. It gives every assignment the same business deadline.
- Number of days: Choose this when the clock should start when each assignment is approved. This is useful for engagements with different start dates.
Microsoft recommends limiting external access to no more than 365 days unless the project is genuinely multiyear. A longer engagement should be renewed deliberately rather than left open-ended.
Free tools Windows power users keep installed
One-click scans. No signup required.
Set an end date with an access package
The exact portal wording can change, but the workflow is in Microsoft Entra ID under entitlement management. You need permission to create and manage access packages and a resource model that clearly identifies the project’s users and assets.
Rank #2
- POWERFUL SECURITY KEY: The YubiKey 5C NFC is the most versatile physical passkey, protecting your digital life from phishing attacks. It ensures only you can access your accounts
- WORKS WITH 1000+ ACCOUNTS: Compatible with popular accounts like Google, Microsoft, and Apple. A single YubiKey 5C NFC secures 100+ of your favorite accounts, including email, password managers, and more
- FAST & CONVENIENT LOGIN: Plug in your YubiKey 5C NFC via USB and tap it, or tap it against your phone (NFC), to authenticate. No batteries, no internet connection, and no extra fees required
- MOST SECURE PASSKEY: Supports FIDO2/WebAuthn, FIDO U2F, Yubico OTP, OATH-TOTP/HOTP, Smart card (PIV), and OpenPGP. That means it’s versatile, working almost anywhere you need it
- PRIMARY & SPARE KEYS: Just like having a spare house key, we recommend buying two YubiKeys - one for daily use and one as a spare. That way you’ll never get locked out of your accounts
- Define the resource bundle. In Identity governance, open Entitlement management and create or select an access package. Add the groups, applications, SharePoint sites, or other resources the contractor needs. Keep unrelated resources out of the package so its expiration has a predictable effect.
- Configure the request policy. Specify whether guests can request the package, whether a connected organization is allowed, required approvers, and any justification or terms-of-use requirement. If an administrator will assign every contractor, restrict self-service requests accordingly.
- Open the assignment-lifecycle settings. In the package’s assignment policy, enable an expiration and select On date or Number of days. Enter the project end date or a duration no longer than your approved maximum.
- Set the expiration behavior. In the control configuration, choose what happens to an expired external user. The package expiration removes the package-associated access. Where the tenant configuration supports it, select the option to remove an external user from the directory after access has ended and no other package assignment remains.
- Assign and test. Assign a test guest or a pilot group, confirm the resources shown in the assignment, and record the calculated expiration. Test both expiration and renewal before applying the policy to a production project.
- Document exceptions. If a multiyear contract needs more than 365 days, record the business owner, end date, renewal approver, and reason. An exception should still have a review cadence.
What happens at expiration
At the expiration time, Entra ends the access package assignment and revokes the resources delivered through it. If the user has no remaining package assignment or other access path, the tenant’s lifecycle configuration can block the guest and later remove the B2B guest account. Do not assume deletion is immediate; the documented stale-guest workflow uses a 30-day block period before deletion.
Add a recurring Access Review
Expiration handles a known deadline, but contractors often finish early, change roles, or stop using an account. A review provides a human or automated check that access is still justified.
Create the review scope
- Open Identity governance and Access Reviews, then create a review for the relevant group, application, access package, or guest population.
- Choose reviewers who can actually confirm business need. Resource owners, project managers, or designated security reviewers are usually more useful than a general administrator who cannot identify the people.
- For stale-account cleanup, select the inactive guest population and set the inactivity threshold. The threshold should reflect your work pattern; a seasonal project may require a longer interval than a weekly collaboration team.
- Set the recurrence. Microsoft lists monthly, quarterly, biannual, and annual schedules and recommends quarterly or more frequent reviews for external access. Choose a shorter interval for sensitive resources or rapidly changing contractor teams.
Configure automatic enforcement
- Enable Auto apply results to resource so a completed decision changes the group, application, or package assignment instead of merely producing a report.
- Set If reviewers don’t respond to Remove access. Without this setting, an ignored review can leave an unnecessary guest active.
- For denied or stale guests, select Block user from signing in for 30 days, then remove user from the tenant when that option is available in your tenant and review type.
- Define notification and escalation owners. Reviewers need enough notice to act, and an owner should receive unresolved or failed-review alerts.
- Start with a pilot scope, inspect the decisions and audit history, and then expand to all external-access groups.
Microsoft documents the workflow in which guests who have not signed in for the configured number of days are disabled for 30 days and then deleted. Treat that as a lifecycle action, not as a substitute for checking other permissions or records that must be retained.
Do these 3 things before closing this tab:
1Fix the driver behind crashes, sound loss and screen glitches2Repair Windows errors before they cause bigger problems3Scan for outdated or missing drivers - takes under a minuteLicensing and prerequisites
Microsoft’s guest-access-review guidance lists Microsoft Entra ID P2 or Microsoft Entra ID Governance as prerequisites for Access Reviews for guests. Confirm the current entitlement for your tenant, users, and review type before rollout; licensing and portal availability can change.
Rank #3
- POWERFUL SECURITY KEY: The YubiKey 5 NFC is the most versatile physical passkey, protecting your digital life from phishing attacks. It ensures only you can access your accounts
- WORKS WITH 1000+ ACCOUNTS: Compatible with popular accounts like Google, Microsoft, and Apple. A single YubiKey 5 NFC secures 100+ of your favorite accounts, including email, password managers, and more
- FAST & CONVENIENT LOGIN: Plug in your YubiKey 5 NFC via USB and tap it, or tap it against your phone (NFC), to authenticate. No batteries, no internet connection, and no extra fees required
- MOST SECURE PASSKEY: Supports FIDO2/WebAuthn, FIDO U2F, Yubico OTP, OATH-TOTP/HOTP, Smart card (PIV), and OpenPGP. That means it’s versatile, working almost anywhere you need it
- PRIMARY & SPARE KEYS: Just like having a spare house key, we recommend buying two YubiKeys - one for daily use and one as a spare. That way you’ll never get locked out of your accounts
- A tenant with Microsoft Entra ID and permission to manage entitlement management and Access Reviews.
- A defined resource owner and an inventory of groups, applications, sites, and packages that grant external access.
- A documented contractor end date or a defensible duration policy.
- Owners and reviewers who will respond to approval and review notifications.
- An offboarding process for direct assignments, privileged roles, shared credentials, and non-Entra systems.
SharePoint guest expiration is not account deletion
SharePoint has a guest-expiration control that applies to a guest’s sharing credential. Microsoft Support explicitly distinguishes guest expiration from disabling or removing an account in Active Directory. A guest whose SharePoint credential expires may still exist in Microsoft Entra ID, remain a member of another group, or retain access to another application.
Use SharePoint’s setting as one layer of sharing hygiene, but keep directory offboarding separate. When a contract ends, remove package assignments, direct group membership, application assignments, and other sharing paths; then use your tenant’s approved block-and-delete process for the guest account.
Why an expired contractor may still have access
Another access package is still active
Package expiration is scoped to one assignment. Check the guest’s other assignments and end or review them separately.
Quick wins for a faster PC:
Repair Windows errors before they cause bigger problemsFix Now →Fix the driver behind crashes, sound loss and screen glitchesFind Drivers →Access was granted directly
A group owner may have added the guest directly, or an administrator may have assigned an application outside entitlement management. Remove the direct assignment or move it into a governed package.
Rank #4
- POWERFUL SECURITY KEY: The Security Key NFC is the essential physical passkey for protecting your digital life from phishing attacks. It ensures only you can access your accounts.
- WORKS WITH 1000+ ACCOUNTS: Compatible with Google, Microsoft, and Apple. A single Security Key NFC secures 100 of your favorite accounts, including email, password managers, and more.
- FAST & CONVENIENT LOGIN: Plug in your Security Key NFC via USB-A and tap it, or tap it against your phone (NFC) to authenticate. No batteries, no internet connection, and no extra fees required.
- TRUSTED PASSKEY TECHNOLOGY: Uses the latest passkey standards (FIDO2/WebAuthn & FIDO U2F) but does not support One-Time Passwords. For complex needs, check out the YubiKey 5 Series.
- BUILT TO LAST: Made from tough, waterproof, and crush-resistant materials. Manufactured in Sweden and programmed in the USA with the highest security standards.
The guest is a member of a nested group
Membership inherited through a nested group can continue to grant access. Trace group nesting and remove the source membership rather than only changing the package.
A separate sharing path exists
SharePoint links, invitations, or application-specific accounts can bypass the package you expired. Review the resource’s sharing and local-account controls.
The review was not enforced
If Auto apply results to resource was disabled, the review may have recorded a decision without changing access. Check the review status and audit events, then apply the result or correct the configuration.
Recommended Free Tools
The guest has not reached the deletion stage
A denied or stale guest may be blocked for the documented 30-day period before deletion. During that period, verify that sign-in is blocked and that no alternate account is being used.
Best Value
- The information below is per-pack only
- POWERFUL SECURITY KEY: The Security Key C NFC is the essential physical passkey for protecting your digital life from phishing attacks. It ensures only you can access your accounts.
- WORKS WITH 1000+ ACCOUNTS: Compatible with Google, Microsoft, and Apple. A single Security Key C NFC secures 100 of your favorite accounts, including email, password managers, and more.
- FAST & CONVENIENT LOGIN: Plug in your Security Key C NFC via USB-C and tap it, or tap it against your phone (NFC) to authenticate. No batteries, no internet connection, and no extra fees required.
- TRUSTED PASSKEY TECHNOLOGY: Uses the latest passkey standards (FIDO2/WebAuthn & FIDO U2F) but does not support One-Time Passwords. For complex needs, check out the YubiKey 5 Series.
Operational checklist for a reliable policy
- Give every contractor a named identity; do not share a single guest account.
- Put project resources in one access package wherever practical.
- Use an explicit end date for known project deadlines and a duration for rolling engagements.
- Keep normal external assignments at 365 days or less unless a documented multiyear exception exists.
- Schedule quarterly or more frequent reviews for external access.
- Enable automatic application of review results and remove access on no response.
- Use the 30-day block-then-delete action for denied or stale guests when supported by the review.
- Check every other package, direct assignment, nested group, role, application account, and sharing path during offboarding.
- Retain audit evidence of approvals, reviewer decisions, expiration, blocking, and deletion.
- Recheck licensing, portal labels, and tenant capabilities before deployment.
A practical policy pattern
For a six-month consulting project, create one access package containing the project group, application, and SharePoint site. Set the assignment to expire on the contractual end date, require project-owner approval, and schedule a quarterly review. If the contract ends early, the owner ends the assignment immediately rather than waiting for the date. The review catches a consultant who stops signing in or whose role changes, while the package keeps the planned deadline enforceable.
For a long-running supplier relationship, use a duration that is no longer than your policy allows, renew it intentionally, and keep quarterly reviews. A renewal is an opportunity to confirm the resource list and remove permissions that the supplier no longer needs.
What this automation does—and does not—guarantee
These settings automate governed Entra access. They do not establish equivalent expiration controls for every SaaS application, non-Microsoft directory, local account, API key, service principal, or data copy. Include those systems in the same offboarding ticket and verify their own expiry and disablement mechanisms.
The safest interpretation of an expiration event is: the access delivered by this package ended. Confirm the broader identity and resource state before declaring the contractor fully offboarded.
Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
