How to check guest invite settings in Microsoft Entra ID

Before you start

Use an account in the Global Reader role, which can read everything a Global Administrator can and change nothing. Changing the settings needs a role such as External Identity Provider Administrator. The PowerShell example requests Policy.Read.All; your organisation may require administrator consent.

Know what the examples leave out. They read who can invite, the guest access level and whether people can join the tenant by verifying their email. The allowed and blocked domains and the cross-tenant access settings are kept elsewhere. The examples read and export; they change nothing.

Option 1

Check guest invite settings with PowerShell

Install the modules once, then connect, read the policy and save the guest settings to a CSV.

# Install once, if the modules are not already installed.
Install-Module Microsoft.Graph.Authentication, Microsoft.Graph.Identity.SignIns -Scope CurrentUser

$ErrorActionPreference = 'Stop'
Connect-MgGraph -Scopes 'Policy.Read.All' -NoWelcome
try {
    $policy = Get-MgPolicyAuthorizationPolicy
    # The guest role template IDs Microsoft documents for guestUserRoleId.
    $access = @{
        'a0b1b346-4d3e-4e8b-98f8-753987be4970' = 'Same as member users'
        '10dae51f-b6af-4016-8d66-8c2a99b929b3' = 'Limited access (default)'
        '2af84b1e-32c8-42b7-82bc-daa82404023b' = 'Restricted to their own profile'
    }
    $report = [pscustomobject]@{
        AllowInvitesFrom          = $policy.AllowInvitesFrom
        GuestUserAccess           = $access["$($policy.GuestUserRoleId)"]
        GuestUserRoleId           = $policy.GuestUserRoleId
        EmailVerifiedUsersCanJoin = $policy.AllowEmailVerifiedUsersToJoinOrganization
    }
    $report | Export-Csv -Path './guest-invite-settings.csv' -NoTypeInformation -Encoding utf8
    Write-Output "Guests can be invited by: $($policy.AllowInvitesFrom)"
} finally {
    Disconnect-MgGraph | Out-Null
}

AllowInvitesFrom is none, adminsAndGuestInviters, adminsGuestInvitersAndAllMembers or everyone, from most to least restrictive. adminsAndGuestInviters means the Global Administrator, User Administrator and Guest Inviter roles. GuestUserAccess turns the guest role ID into its access level.

Option 2

Check guest invite settings in the admin centre

1. Sign in to the Microsoft Entra admin centre for the correct tenant.
2. Go to Entra ID > External Identities > External collaboration settings.
3. Under Guest user access, read which of the 3 access levels is selected.
4. Under Guest invite settings, read which option is selected, from Anyone in the organization can invite guest users to No one in the organization can invite guest users.
5. Under Collaboration restrictions, read whether invitations are allowed or denied for listed domains. Leave the page without saving.

This suits a look at 1 tenant, with the domain lists the script doesn't read. For a record you can compare month to month, use PowerShell or a report.

Common questions

Can a Guest Inviter invite when invitations are limited to admins?

Yes. The Guest Inviter role can invite guests even when only users in specific admin roles can, so it is a way to let 1 person invite without a wider admin role.

Does this setting stop guests from a particular company?

No. Allowing or blocking domains is under Collaboration restrictions on the same page, and the cross-tenant access settings decide collaboration with other Microsoft Entra organisations.

How do I see the guests who have already been invited?

List the guest accounts and their invitation state. See how to list guest users.