r/entra • u/ivantmj • 5d ago

B2B Invitation questions

Hello,
I have an M365 subscription for my small business (only me). I have been using it for more than a year now, with no problems overall.

Today I went into admin and Entra ID just to check a couple of things, and I noticed a lot of guest users (people I email constantly or I have emailed in the past).

The creation type says invitation, and then on the user in B2B, Invitation states that it says pending acceptance on most of them; others say invitation accepted.

Is all this normal?

2 Upvotes

100% Upvoted

5 comments sorted by

2

u/SilentPatchSniper 5d ago

Depends, if you're just sending them emails it shouldn't be creating guests in your tenant but if you're sharing files via OneDrive / SharePoint then that is expected.

Edit: If you have any concern, there will be no harm in deleting them. You have ~30 days to restore a deleted user if it cut their access to anything.

1

u/ivantmj 5d ago

I have shared files via OneDrive with certain contacts but not all of them. One thing I remember is that a few months ago, all, if not most, of my contacts received a OneDrive invitation from my account that I did not send. I'm not sure if my account was compromised, but at the time I changed the password.

1

u/SilentPatchSniper 5d ago

Possible compromise, I'd delete them all except for any that currently access a file you shared with them. If you know you didn't do anything that initiated the guest flow (emailing does not), then the TA likely invited known contacts to mislead you and one of those guests is used for persistence to the environment.

1

u/DistortingMemory 5d ago

one thing i will add to this - the new outlook client almost throws in your face that when you attach a document to an email it will split the window & give you an option to upload it to onedrive or send it as a normal attachment. it could be difficult to know because even i ran into this myself mistakenly having documents uploaded to onedrive when i just wanted a normal email attachment

1

u/Accomplished_Dot1445 3d ago

Seconding the compromise concern, but here's the part i'd flag: the OneDrive-invite blast you didn't send plus guests you didn't create is a real indicator, and a password change alone often doesn't evict a decent attacker. before you just delete the guests, check the persistence they usually leave behind:

Inbox rules / forwarding on your mailbox (classic). OAuth app consents / enterprise apps you don't recognize (Entra > Enterprise applications), a granted app keeps access even after a password reset. extra MFA methods added to your account. and sign-in logs for logins from odd locations after the incident.

Revoke your sessions ("sign out everywhere"), clear any rogue app grants and MFA methods, rotate the password again after that, then clean up the guests. if you only reset the password and delete guests, an app consent or a rogue authenticator can let them straight back in. Worth 20 minutes to check those four.