How to find guests with access to Azure

Before you start

Use an account that can read role assignments at the scopes you want to check, such as one with the built-in Reader role, and that can read users in the directory. A member account can by default; a guest account has restricted directory permissions and can't look the users up. The script reads each user's UserType through Microsoft Graph with the same Azure sign-in. Microsoft lists no separate licence for reading assignments.

A guest is a user invited from another organisation through Microsoft Entra B2B collaboration. The examples list the roles a guest holds directly; a role held through a group shows as the group's assignment. They read and export, and change nothing. The script's finally block disconnects the account and clears its saved Azure contexts.

Option 1

Find guests with access to Azure with PowerShell

Install the modules once. The script reads the user assignments of each enabled subscription, looks up each user's type once, and saves the assignments held by guests.

Install-Module -Name Az.Accounts, Az.Resources -Repository PSGallery -Scope CurrentUser

$ErrorActionPreference = 'Stop'
Connect-AzAccount -ErrorAction Stop
try {
    $subscriptions = @(Get-AzSubscription | Where-Object State -eq 'Enabled')
    if ($subscriptions.Count -eq 0) {
        Write-Output 'No enabled subscriptions are available to this account.'
        return
    }
    $assignments = @{}
    foreach ($sub in $subscriptions) {
        Set-AzContext -Subscription $sub.Id -Tenant $sub.TenantId -Scope Process | Out-Null
        Get-AzRoleAssignment | Where-Object ObjectType -eq 'User' |
            ForEach-Object { $assignments[$_.RoleAssignmentId] = $_ }
    }
    $userType = @{}
    $ids = @($assignments.Values | ForEach-Object ObjectId | Sort-Object -Unique)
    foreach ($id in $ids) {
        $user = Get-AzADUser -ObjectId $id -Select 'UserType' -AppendSelected
        $userType[$id] = $user.UserType
    }
    $rows = @($assignments.Values | Where-Object { $userType[$_.ObjectId] -eq 'Guest' } |
        Sort-Object SignInName, Scope)
    if ($rows.Count -eq 0) {
        Write-Output 'No guest holds an Azure role directly.'
    } else {
        $rows | Select-Object DisplayName, SignInName, RoleDefinitionName, Scope,
            ObjectId, RoleAssignmentId |
            Export-Csv -Path './azure-guest-access.csv' -NoTypeInformation -Encoding utf8
        Write-Output "$($rows.Count) guest assignments saved to azure-guest-access.csv."
    }
} finally {
    Disconnect-AzAccount | Out-Null
}

The CSV holds the guest's name and sign-in name, the role, the scope, the object ID and the assignment ID. An assignment at a management group or the root is read from every subscription it reaches, so the script keeps each assignment ID once. To narrow the check, filter $subscriptions, or add -RoleDefinitionName 'Owner' to Get-AzRoleAssignment to keep 1 role.

See every role 1 guest holds

Reconnect, then read 1 guest's assignments in the current subscription, including the roles held by the groups they belong to.

# Run while connected to Azure. Replace the example object ID.
Get-AzRoleAssignment -ObjectId '00000000-0000-0000-0000-000000000000' -ExpandPrincipalGroups |
    Select-Object DisplayName, RoleDefinitionName, Scope

Option 2

Review a guest's Azure roles in the Azure portal

1. Sign in to the Azure portal with an account that can read the directory and the subscriptions' role assignments.
2. Choose All services > Microsoft Entra ID > Users.
3. Select Add filter, choose User type and select Guest.
4. Select a guest, then Azure role assignments, to list the roles assigned to them at each scope you can read.
5. To see another subscription, choose it in the Subscriptions list.

This suits a check of a few named guests. It works through 1 guest and 1 subscription at a time, so for every guest across every subscription, use PowerShell or Altivane.

Common questions

A guest has access but isn't in the list. Why?

The role is most likely held through a group. Run Get-AzRoleAssignment with the guest's object ID and -ExpandPrincipalGroups, as above, to see the roles their groups hold.

Why does the script stop when it looks up a user?

The account can't read users in the directory, which is usual for a guest account. Run it again with a member account, or one that holds the Directory Readers role.

How do I find guests who never accepted their invitation?

That is a question about the guest accounts, not their Azure roles. See how to list guest users in Microsoft Entra ID.