Guest accounts holding paid Microsoft 365 licenses
Guest accounts exist so external people can collaborate in Teams and SharePoint without a seat in your tenant. When a guest ends up holding a paid license anyway, you are paying for an external user who usually should not consume one, and often for a collaboration that ended long ago.
How guests end up licensed
Most guest collaboration needs no license assigned in your tenant: sharing settings and the guest's own organization cover the common Teams and SharePoint scenarios. Paid licenses land on guests anyway, through group-based licensing rules that match external accounts, through a manual assignment made to unblock a project, or through a contractor setup that outlived the contract.
Because guests sit outside the joiner-mover-leaver process, nobody offboards them when the engagement ends. The account stays enabled, the license stays assigned, and no internal process ever touches it again.
Detect it manually
A Graph advanced query lists every guest account that holds at least one license:
Connect-MgGraph -Scopes 'User.Read.All'
$p = @{
Filter = 'userType eq ''Guest'' and assignedLicenses/$count ne 0'
ConsistencyLevel = 'eventual'
CountVariable = 'c'
All = $true
}
Get-MgUser @p | Select-Object DisplayName, UserPrincipalName, UserType- Filtering on userType and on assignedLicenses/$count are both Graph advanced-query features, so the ConsistencyLevel eventual header and the count request are required. The single-quoted filter keeps PowerShell from expanding $count, with the inner quotes around Guest doubled.
- Review the list before removing anything: a few guest licensing setups are deliberate, such as externally licensed contractors. The point is that each one should be a decision, not a leftover.
How LicenseMeter detects it
The directory sync carries each user's userType, and the rule fires when an account with userType Guest holds at least one license. The finding is priced at the sum of every SKU the guest carries.
Like the disabled-account and shelfware rules, this is pure directory data: it works without Entra ID P1 and is unaffected by concealed report names, so licensed guests are caught in every tenant configuration.
What it costs
Each licensed guest is priced at the full monthly cost of the SKUs assigned to the account, from the editable per-tenant price book prefilled with list-price estimates.
In the 155-person sample tenant, paid licenses on guest accounts waste € 110,10 a month.
Sample figures come from the deterministic demo workspace, not from customer data. The waste calculator turns your own seat count into an estimate.
Related waste patterns
See which of your seats match this pattern.
Connect read-only and the free scan lists every affected account in your tenant, priced per seat and per month, with a PowerShell remediation script your IT reviews and runs.
After the free scan, 14 days of full monitoring, free. No credit card, read-only access.