Find guest users
Documentation: Microsoft Learn
A userType eq 'Guest' filter is evaluated by Graph, with the literal in single quotes because OData string comparisons require them.
The script
Script reader
Inspect before you run
Inspect the script below. It does not run in this browser.
Inspection only — no command has run.
Show reference output
Inspect this example’s structure
Read the command and its supplied arguments. This example requires real PowerShell or its module; this diagram does not execute it.
Get-MgUser -All -Filter "userType eq 'Guest'" -Property DisplayName,UserPrincipalName,CreatedDateTime | Select-Object DisplayName,UserPrincipalName,CreatedDateTime- Stage 1Get-MgUser
-All -Filter -Property - Stage 2Select-Object
Positional values or no named parameters
How it works
A userType eq 'Guest' filter is evaluated by Graph, with the literal in single quotes because OData string comparisons require them. Paging is handled by -All, and CreatedDateTime travels with the names so the age of each invitation shows in the result.
Adapting it
Add ExternalUserState to the requested properties to split guests who accepted their invitation from those still sitting in PendingAcceptance, and the pending ones can usually be removed without consulting anyone.
Requirements
Microsoft.Graph module and a Graph session with User.Read.All.
If the result is unexpected
Expected guests are missing or external-looking addresses are classified as members.
An external email domain does not by itself determine the UserType property.
- Inspect UserType and identity data for a known account in the intended tenant.
Validate the result
Guest results satisfy the chosen UserType filter; exceptions are reviewed by identity rather than address alone.
Keep the check reliable
Keep guest classification separate from email-domain classification.
