ACSC Logo
© GEMXIT
GEMXIT Logo
Agent Foskett Investigation • Microsoft Entra B2B • SharePoint • Guest Access • Microsoft Sentinel • KQL

Who Invited the Guest Who Could Read the Finance Files?

The Finance team found an unfamiliar name on a SharePoint access list.

The account was marked Guest.

The invitation had been accepted. The files were available. And nobody in Finance recognised the visitor.

Agent Foskett opened his notebook.

“An unexpected guest in Finance? I hope someone checked the invitation list.”

Discuss identity securityBack to investigations
Agent Foskett investigating Microsoft Entra guest access to SharePoint finance files
Guest Access Investigation

The guest existed. The real question was how that identity obtained access to Finance.

Trace the invitation and redemption
Identify the access-granting permission
Review evidence of actual file access

The name that did not belong

A routine permissions review revealed an external identity on a sensitive SharePoint site.
An unfamiliar guestThe external account was visible in the tenant directory, but Finance did not recognise the person.
A sensitive document libraryThe site held budget forecasts, invoices and other confidential financial records.
An invitation was not an explanationA successful B2B invitation tells us an external identity was onboarded. It does not establish business approval.

The first mistake would have been to blame the guest

The account could have arrived through an approved collaboration workflow, a mistaken share, group membership or an unauthorised invitation. Start with evidence, not assumptions.
Who invited the account?Find the invitation and subsequent redemption evidence in Microsoft Entra audit logs.
Who granted access?Examine SharePoint sharing links, direct permissions and any groups that confer access.
What did the guest do?Review available Microsoft 365 audit events for file access, sharing and downloads.

A reconstructed investigation timeline

Illustrative case timeline, not a claim about a real tenant. All timestamps are local to the fictional investigation.
case-timeline.txt
  1. 1
  2. 2
  3. 3
  4. 4
  5. 5
  6. 6
  7. 7
  8. 8
09:08  Guest invitation initiated
09:11  Invitation redemption completed
09:17  Guest added to a collaboration group
09:19  Group permission reaches Finance site
10:04  Finance file access recorded
10:12  Finance administrator raises concern

Find the guest and invitation activity

In a Microsoft Sentinel workspace receiving Microsoft Entra audit logs, AuditLogs can reveal invitation, redemption and group changes. Operation names vary; start broad and inspect the returned records.
guest-invitation-audit.kql
  1. 1
  2. 2
  3. 3
  4. 4
  5. 5
  6. 6
  7. 7
  8. 8
  9. 9
AuditLogs
| where TimeGenerated > ago(30d)
| where Category in~ ("UserManagement", "GroupManagement")
| where OperationName has_any ("invite", "invitation", "guest", "member")
| project TimeGenerated, OperationName, Result,
          InitiatedBy, TargetResources, CorrelationId
| order by TimeGenerated asc

Identify the actor behind the invitation

The InitiatedBy object may identify a user or application. An actor recorded in a log is an investigative lead, not proof that the named person knowingly approved the invitation.
invitation-initiator.kql
  1. 1
  2. 2
  3. 3
  4. 4
  5. 5
  6. 6
  7. 7
  8. 8
  9. 9
  10. 10
AuditLogs
| where TimeGenerated > ago(30d)
| where OperationName has_any ("invite", "invitation")
| extend ActorUser = tostring(InitiatedBy.user.userPrincipalName),
         ActorApp = tostring(InitiatedBy.app.displayName)
| project TimeGenerated, OperationName, ActorUser,
          ActorApp, TargetResources, Result, CorrelationId
| order by TimeGenerated asc

The clue was a group membership

The investigation found that the guest was added to a collaboration group. The group already had access to the Finance SharePoint site. That is the potential access path to validate.
Directory membershipConfirm the guest was a member of the group at the relevant time; current membership alone cannot reconstruct history.
SharePoint permissionInspect the site and library permission assignments and determine what role the group received.
Effective accessCheck inheritance, direct shares and links. Multiple paths can grant the same guest access.

Hunt for guest-related group changes

AuditLogs can help establish when an external identity was added to a group. Expand target resources and modified properties to verify the specific guest and group identifiers.
guest-group-changes.kql
  1. 1
  2. 2
  3. 3
  4. 4
  5. 5
  6. 6
  7. 7
  8. 8
  9. 9
  10. 10
  11. 11
  12. 12
AuditLogs
| where TimeGenerated > ago(30d)
| where Category =~ "GroupManagement"
| where OperationName has_any ("Add member", "Remove member")
| mv-expand Target = TargetResources
| project TimeGenerated, OperationName,
          TargetName = tostring(Target.displayName),
          TargetId = tostring(Target.id),
          InitiatedBy, Result, CorrelationId
| order by TimeGenerated asc

A successful guest sign-in was another clue

SigninLogs may include external-user activity when the tenant exports the relevant sign-in data. Match the guest using the actual object ID or UPN from your environment; do not assume the #EXT# display format alone is reliable.
guest-signins.kql
  1. 1
  2. 2
  3. 3
  4. 4
  5. 5
  6. 6
  7. 7
  8. 8
  9. 9
SigninLogs
| where TimeGenerated > ago(30d)
| where UserType =~ "Guest"
| project TimeGenerated, UserPrincipalName, UserId,
          AppDisplayName, IPAddress, ResultType,
          ConditionalAccessStatus, DeviceDetail
| order by TimeGenerated desc

Did the guest actually open or download files?

Microsoft 365 unified audit data may be available in the OfficeActivity table when configured for Sentinel. Search the Finance site and relevant file operations; verify exact operation names and record coverage in your tenant.
sharepoint-finance-activity.kql
  1. 1
  2. 2
  3. 3
  4. 4
  5. 5
  6. 6
  7. 7
  8. 8
  9. 9
  10. 10
  11. 11
OfficeActivity
| where TimeGenerated > ago(30d)
| where OfficeWorkload =~ "SharePoint"
| where Operation in~ ("FileAccessed", "FileDownloaded",
                       "SharingSet", "SecureLinkCreated")
| where Site_Url has "finance"
| project TimeGenerated, Operation, UserId,
          Site_Url, OfficeObjectId, ClientIP
| order by TimeGenerated asc

The missing distinction: access versus activity

An account appearing on a permission list is not evidence that it read or downloaded a document. The case required two separate conclusions.
Permission establishedThe group assignment and SharePoint permissions supported the conclusion that the guest could access the Finance library.
Activity separately investigatedAudit records were reviewed to determine whether files were opened, downloaded or shared.
Visibility limits documentedA missing event is not proof of no activity; audit ingestion, retention and operation coverage must be verified.

The six-stage investigation

Agent Foskett reconstructed the sequence rather than relying on the current access list.
1 — DiscoverAn unfamiliar guest was identified on a Finance access review.
2 — IdentifyDirectory records established the guest identity and invitation context.
3 — CorrelateAudit records linked the invitation to a group membership change.
4 — ValidateSharePoint permissions showed how the group reached the Finance library.
5 — AssessAvailable file activity was checked for access, downloads and sharing.
6 — ContainThe owner reviewed the access grant and removed unnecessary permissions, preserving evidence first.

What the organisation should do next

A safe response preserves evidence, confirms business need and prevents unnecessary exposure without automatically disrupting legitimate collaboration.
Confirm the sponsorAsk the site owner who approved the collaboration, what files were needed and for how long.
Review and reduce accessRemove unintended group membership, overly broad sharing links or site permissions; revoke sessions if compromise is suspected.
Improve the processApply guest access reviews, least-privilege groups, expiration policies and alerts for sensitive-site sharing.

Investigation findings

In this fictional case, the access path was a guest invitation followed by membership in a group that already had Finance permissions.
The guest was not imaginaryEntra audit data established an invitation and redemption sequence.
The group explained the accessGroup membership and SharePoint permissions explained why the account could read Finance files.
Approval remained a separate questionThe technical record did not, by itself, prove that the access had been approved by the Finance owner.

Related Agent Foskett investigations

Continue investigating identity access, administrative changes and the evidence behind successful sign-ins.
At 3:21 AM, Someone Changed the Retention PolicyFollow an unexpected Microsoft Purview administrative change.
The Password Was Correct — But Nobody Had Typed ItInvestigate authentication evidence that does not fit the expected user story.
The Conditional Access Result Said Success — But That Wasn't the Whole StoryUnderstand why successful access controls are not the end of an investigation.
The guest had access. The audit trail had the questions.
Trace invitations, group membership, effective permissions and actual file activity.
Visit the Agent Foskett Academy

Final thought

Agent Foskett closed the case file. “I do not object to guests. I object to finding them in Finance without anyone knowing who invited them.”
Invitation is not approvalThe invitation event established a technical action, not the business authorisation behind it.
Access is not a downloadEffective permissions and actual document activity are different evidence questions.
The logs already knewThe identity, group and SharePoint records made the access path explainable.
Develop IT. Protect IT.
GEMXIT PTY LTD | GEMXIT UK LTD
Talk to GEMXIT
ACSC Logo

GEMXIT PTY LTD  |  GEMXIT UK LTD  |  © GEMXIT

Who Invited the Guest Who Could Read the Finance Files?

Microsoft Entra Guest Access and SharePoint Investigation

Microsoft Sentinel KQL and Microsoft 365 Auditing