Guest access is on in your organisation, but for one team, such as Board, HR or Payroll, you don't want external people. Turning off guest access for the whole tenant is too blunt: other teams do work with customers and partners. Fortunately you can block guests per team. Without PowerShell you do that with a sensitivity label in Microsoft Purview; with PowerShell you set a property on that one group. This article covers both, and what to watch out for.
How does it work?
Every team runs on a Microsoft 365 group. Whether owners can add guests is a property of that group: AllowToAddGuests. A sensitivity label sets that property for you, and you simply pick the label in Teams. For who can do what in a team, see owners, members and guests in Microsoft Teams.
One time: enable labels for groups and sites
By default, sensitivity labels only apply to files and emails. For teams, an admin has to enable them once:
- In Microsoft Entra ID, set the group setting
EnableMIPLabelsto True (with Microsoft Graph PowerShell). - Connect to Security & Compliance PowerShell and run
Execute-AzureAdLabelSync.
Until that's done, you'll see the group and site settings in the label wizard, but you can't select them.
With a sensitivity label (no PowerShell)
- Go to purview.microsoft.com > Information protection > Sensitivity labels > Create a label, for example Internal - no guests.
- Choose Groups & sites as the scope (optionally alongside Files & emails).
- In the protection settings for groups and sites, choose Privacy and external user access settings.
- Under External user access, untick Let Microsoft 365 group owners add people outside your organization to the group as guests. Optionally set privacy to Private.
- Publish the label with a label policy for the users who create or manage teams.
- Wait at least an hour. Then pick the label in Teams under Manage team > Settings > Sensitivity, or when creating a new team.
The exact option names can differ slightly between versions of the Purview portal. If you later change the group settings of a label already in use, allow about 24 hours for every team to pick it up.
Licence
Applying sensitivity labels to groups requires Microsoft Entra ID P1 and a licence with Purview information protection, such as Microsoft 365 Business Premium, E3 or E5.
With PowerShell
Without labels, set AllowToAddGuests to false for that one group. Microsoft uses the beta Microsoft Graph PowerShell module for this:
Connect-MgGraph
$templateId = (Get-MgBetaDirectorySettingTemplate | ? {$_.DisplayName -eq "Group.Unified.Guest"}).Id
$groupId = (Get-MgBetaGroup -Filter "DisplayName eq 'Board'").Id
$params = @{ templateId = $templateId; values = @(@{ name = "AllowToAddGuests"; value = "false" }) }
New-MgBetaGroupSetting -GroupId $groupId -BodyParameter $params
It works, but it's harder to manage than a label: Teams doesn't show which teams are set this way, and you have to adjust every new team yourself.
Existing guests and the SharePoint site
- Existing guests stay members until you remove them. New guests can no longer be added. Remove them via Manage team > Members.
- The team's SharePoint site has its own external sharing settings. A label can restrict those too; otherwise set sharing for that site separately. Sharing options greyed out afterwards? Read sharing options greyed out.
Check it
As an owner, try adding an external address via Add member. Teams no longer allows it and says guests aren't permitted.
Common problems
- The label doesn't appear in Teams: the label policy isn't published to that user yet, or synchronisation is still running.
- The option in the label wizard is greyed out: labels for groups and sites haven't been enabled yet.
- External people still get in: through a shared channel or direct sharing from SharePoint, which is separate from guest membership of the team.
FAQ
Can I turn off guest access for the whole organisation?
Yes, but that's a tenant setting. Read check and manage guest access in Teams.
What if a team needs guests later?
Assign a different label. With PowerShell, set the value back to true. For ongoing control, see technical governance for Microsoft Teams.
Nederlandstalige versie: Gasttoegang uitschakelen voor één team in Microsoft Teams