Entra ID Governance covers employees well. Lifecycle Workflows handle joiner, mover, and leaver. Entitlement Management runs access packages. Access Reviews keep permissions honest. For internal identities the story is close to complete.

Guests are a different matter. B2B collaboration grows in every organization, and the built in governance features leave real gaps for external identities. Accounts pile up after the project that needed them ended, access outlives its purpose, and ownership is unclear enough that cleanup never happens.

We start by mapping what actually exists, applied to guests in a live tenant, including the boundaries you hit and the scenarios that fall through. No slides claiming coverage the product does not deliver.

Then the solution built to close the gap: a Logic Apps based Guest User Lifecycle Management workflow handling invitation, periodic review, and cleanup. The running workflow, the Graph calls behind it, how sponsors are notified and what happens when they ignore the mail, and the guardrails that stop an automated deletion from removing the wrong account. It is on GitHub and deployable in your own tenant.

What it cost to get there is part of the session: where Logic Apps turned out to be the wrong tool, the Graph throttling behaviour that forced a redesign, the exclusion guard added after a near miss, and what still needs a human decision. For identity architects and IT professionals who own B2B collaboration and are tired of guest accounts nobody can account for.