I'm developing an entitlement management solution that lets external users from multiple companies request access to an application for reading work orders. Each company will have its own access package, and the target rollout is planned for around mid-to-late September.
The current design sends an access package link to the guest through an internal contact. The guest authenticates with a Microsoft account or email one-time passcode, and their email domain is matched to the appropriate connected organization so users from other companies cannot request the package. Requests require internal approval and a security-question response. Once approved, a guest account is created automatically, and the guest must use the company's authenticator-based MFA to sign in. Additional Conditional Access controls are also being evaluated.
Has anyone deployed access packages at scale—hundreds of users or more—for external and internal access across applications, SharePoint, Teams, or other resources? I'm especially interested in experiences supporting many different companies and use cases, including governance, approvals, guest lifecycle management, and operational issues.
Our organization has more than 15,000 employees across several states, and external access is currently handled through manual guest invitations and ticket requests. If this pilot succeeds, the business wants to expand access packages to many other scenarios, so I'd appreciate practical feedback on the strengths, limitations, and lessons learned from using them broadly.
2 Answers
Access packages work very well for project- or role-based access. A package can bundle groups, applications, SharePoint sites, Teams, and even privileged access workflows, with approvals routed to security teams or project owners. The biggest benefit is lifecycle management: set expiration and review requirements so access is automatically removed when someone leaves a project or no longer needs the resources. That approach scales well for both internal employees and external collaborators.
We use hundreds of access packages for both internal and external users, including application access and a large number of SharePoint resources. Packages can also place users into groups that are used as approvers for other packages, which helps build structured delegation. At that scale, consistent naming, ownership, expiration policies, access reviews, and clear package design are important to keep administration manageable. One area to plan for is guest profile enrichment: accounts created through packages may not automatically contain fields such as company or manager, so you may need an automated identity-governance or directory process to populate and maintain those attributes.
That’s useful to know. I’ll make guest profile enrichment part of the design rather than assuming the access package will populate those attributes automatically.