Microsoft Entra's New Sponsored Guests Experience Puts Governance in the Hands of Business Owners

-

Organizations today collaborate with an ever-growing number of external partners, contractors, vendors, and consultants. While Microsoft Entra Guest Accounts make external collaboration seamless, ensuring those guests continue to need access has traditionally required significant administrative oversight.

Microsoft is addressing this challenge with Manage Sponsored Guests in My Account (Preview), a new capability that helps sponsors directly participate in guest lifecycle governance.

Why Sponsored Guests Matter

A sponsor is the person or group responsible for a guest user's ongoing relationship with an organization. Sponsors are often the people best positioned to answer critical questions:

  • Does this guest still need access?
  • Is the business relationship still active?
  • Should access be extended or removed?

Rather than relying solely on IT administrators to make these decisions, Microsoft Entra now enables sponsors to review and manage the guests they are responsible for through the familiar My Account experience. 

What the Preview Delivers

The new Sponsored Guests experience allows sponsors to:

  • Review all guests they currently sponsor
  • Identify guests who require sponsorship renewal
  • View guest details and access-related information
  • Extend sponsorship when business justification still exists
  • End sponsorship when responsibility or the relationship no longer exists
  • Sponsor eligible unsponsored guest accounts when required

This moves guest governance closer to the people who understand the actual business need, reducing dependency on IT for routine validation tasks.



A Better Governance Model

One of the most interesting aspects of this feature is how it supports policy-driven access management.

Administrators continue to configure guest lifecycle policies within Microsoft Entra ID Governance, including:

  • Sponsorship renewal requirements
  • Notification schedules
  • Grace periods
  • Enforcement actions
  • Minimum sponsor requirements

Sponsors don't manage the policy itself. Instead, they provide attestations confirming whether a guest still requires access.

This separation creates a stronger governance model:

IT defines the rules.

Business owners validate necessity.

Microsoft Entra enforces compliance.

Real-World Benefits

For many organizations, guest accounts accumulate over time because ownership becomes unclear. Former contractors, expired vendor relationships, and abandoned partner accounts can remain active longer than intended.

The Sponsored Guests experience helps address this by:

  • Improving accountability
  • Increasing visibility into external identities
  • Supporting access reviews
  • Reducing stale guest accounts
  • Strengthening Zero Trust initiatives

Sponsors gain the context they need to make informed decisions, while administrators gain confidence that guest access remains aligned to business requirements.

Important Preview Considerations

As with any preview feature, there are a few things to keep in mind:

  • The feature is currently in Preview.
  • Organizations must have guest lifecycle policies configured in Microsoft Entra ID Governance.
  • Users must be authorized to act as guest sponsors.
  • Extending sponsorship records a sponsor's attestation that access is still required, but it does not guarantee continued access if other policy requirements are not met.

Final Thoughts

The introduction of Sponsored Guests in My Account is a welcome evolution for Microsoft Entra governance. By empowering sponsors to actively manage the guest identities they're responsible for, organizations can improve security, reduce administrative burden, and ensure external access remains tied to legitimate business needs.

As guest access continues to grow across modern enterprises, features like this help move governance from being an IT-only responsibility to becoming a shared accountability model between technology and the business.

Comments

Post a Comment

Popular posts from this blog

Using Custom Connectors and Microsoft Graph API's to Manage Licenses in Power Automate - Part One

-
Happy June folks! I come to you with another post, but this time I wanted to change it up and show you something else I have just finished working on. As a SysAdmin, one of the most common issues we run into is managing licenses. Working at a post-secondary institution makes this an even greater challenge, as you have both students, staff and faculty constantly coming as well as going. Managing to keep up with this constant change can introduce great administrative overhead which takes away time from important upkeep of other systems and initiatives. You may also notice this same issue in large corporations or in other government organizations. To help combat this, I wanted to create a flow that can do the following: Get the user and their licenses Determine their last sign-in and the date Conditional to determine if the user is past the "cutoff" date Remove the user from a group where the license is assigned The only problem with doing this is that Power Automate does not ha...
Read more

Building a Modern Conditional Access Strategy: The Identity Firewall Your Organization Actually Needs

-
Conditional Access has evolved from a simple MFA enforcement tool into the central identity firewall of Microsoft Entra. It decides who can access resources, under what conditions , and how trust should change in real time . Organizations that treat Conditional Access as an architecture, not a configuration, build dramatically stronger identity security with far less operational overhead. This article outlines how to build a modern Conditional Access strategy and highlights the Entra features that make it possible. 1. Start With Identity Risk, Not MFA A modern strategy begins with understanding identity risk. Before writing policies, map out: Human identity risks Workload identity exposure External user access patterns Legacy protocol dependencies Administrative access pathways Entra features that support this: Identity Protection (user risk, sign‑in risk, token theft detection) Risky sign‑in reports Risk-based Con...
Read more

HEADS UP: The 2027 Microsoft MFA Shift Is Coming - What You Need To Do Now

-
Microsoft is making one of its most significant identity security changes in years: retiring Microsoft‑provided SMS and voice authentication on February 1, 2027 . For many organizations, this will be a major transition and the timeline is tighter than it looks. If you’re an IT admin, identity engineer, or security leader, this shift isn’t just a technical update. It’s a strategic moment to modernize your authentication stack, reduce risk, and prepare your users for a passwordless future. Below is a clear, actionable breakdown of what’s changing and how to get ahead of it. Why Microsoft Is Retiring SMS & Voice MFA SMS and voice codes have long been the “easy button” for MFA enrollment. But they’re also the least secure : Vulnerable to SIM swapping Easily intercepted through phishing Increasingly targeted by AI‑powered social engineering Difficult to guarantee across global telecom networks Microsoft’s data shows that modern phishing kits can bypass SMS/voice MFA with alarming s...
Read more