How are you controlling guest access in Entra B2B?

Start by separating guest invitations from permissions to individual resources. Restrict who can invite guests in Entra, then look at the Teams, SharePoint and group settings that determine where those guests can be added. Creating a guest account does not by itself grant access to every site, but an owner may still be able to grant access later.

You can also restrict B2B collaboration to known domains and use external sharing settings in Teams and SharePoint for additional control. Check those settings together rather than assuming one domain restriction covers every sharing path.

One approach is to disable guests when Microsoft 365 groups are created, then allow them only for approved groups. That leaves room for collaboration without treating every group as external-ready.

For groups that do allow guests, make the owners review access regularly. Sensitivity labels can also help distinguish internal-only teams from those where guest access is permitted, though that adds some administration.

Blocking guest access by default and opening it per request is a reasonable choice if tracking scattered access is the bigger concern. It does create overhead, but it gives you a clear approval point before external collaboration starts.

For file sharing, check the guest access expiration option in SharePoint admin settings. That can help prevent file and folder access from hanging around indefinitely, including sharing through SharePoint and OneDrive.

Don't assume that setting also expires membership in a Team. Group membership and file access need separate governance.

Guest controls are only one part of protecting the content. Group configuration can limit where guests become members, while tools such as Purview data loss prevention can add controls around sensitive information. Those controls complement access management rather than replacing it.