Two features let outsiders into your collaboration environment, and confusing them is the most common external-collaboration mistake in the field. Guest access adds an external person as a member of specific teams inside your tenant. External federation lets your users chat and call people in other tenants without anyone joining anything. Different controls, different risks, different owners.
Choosing the Right Door
- Guest access when the outsider works on your artefacts: your files, your channels, your plans. They receive a directory identity in your tenant and appear in your member lists.
- Federation when the outsider merely communicates: supplier support, peer contacts at partners. No membership, no file access by default.
- Shared channels when a standing joint workspace is needed between two organisations without making anyone a full guest of the other — the cleanest option for long-running partner projects.
Provisioning Guests Without Regret
- Require a named internal sponsor per guest; the sponsor owns the business justification and the eventual removal.
- Add guests to specific teams only — never to org-wide groups, which would silently widen their reach.
- Set an expiry at creation. Projects end; sponsor memory does not survive reorganisations.
- Name guests visibly in your directory (a "GUEST" suffix or attribute) so every report and every colleague can see the boundary.
What guests can and cannot do
Guests participate in conversations and files of the teams they join, but platform capabilities differ from members: they typically cannot see your org-wide directory, create teams, or access channels they were not added to. The exact matrix is configurable per tenant — document yours, because "I assumed guests could not see that" is not a control.
The Review Ritual
Quarterly, produce the guest list with sponsor, team, and last-activity date. Three outcomes per row: renew with reason, remove now, or escalate to the sponsor with a deadline. An unreviewed guest list is an access-control fiction; auditors know this and ask for the review evidence, not the list.
Federation Boundaries
Open federation means any user at any organisation can initiate a chat with your people — convenient, and a favourite channel for phishing that appears to come from a collaboration client. Restrict federation to an allow-list of partner domains where your business permits, and educate staff that an external chat badge means exactly what it says: this person is outside the building.
Auditing External Activity
The compliance centre's audit log records guest additions, external shares and federation events. Build two standing alerts: a guest added to a team containing confidential-labelled content, and any anonymous sharing link created. Those two signals catch the majority of external-boundary incidents early enough to matter.
Boundaries define who is in the room. The next question people actually ask is about time: what gets kept, for how long, and who can still read it afterwards — retention, plainly explained.
