1. Sign in to the Azure portal using your administrator credentials.
2. In the left-hand menu, click on “Azure Active Directory”.
3. Under “Manage”, select “Users”.
4. On the “Users” page, click on the “Guest users” tab.
5. Review the list of guest users to determine which ones need to be removed.
6. Select the guest user that you want to remove by clicking on the checkbox next to their name.
7. Click on the “Remove” button at the top of the screen.
8. Confirm that you want to remove the guest user by clicking “Yes” in the confirmation dialog box.

​

1. Run the following command to list all the external/guest users in your Azure Active Directory tenant:
   az ad user list --query "[?userType=='Guest']"
   
2. Identify the guest users that should not have access to your Azure resources.
3. Run the following command to remove a guest user:
   az ad user delete --id <guest-user-object-id>
   
   Replace <guest-user-object-id> with the object ID of the guest user you want to remove.
4. Repeat step 3 for all the guest users that should not have access to your Azure resources.
5. After removing the guest users, you can also disable external sharing for your Azure Active Directory tenant by running the following command:
   az ad domaingroup update --id <object-id-of-the-external-users-group> --set "securityEnabled=true"
   
   Replace <object-id-of-the-external-users-group> with the object ID of the group that contains all the external users in your Azure Active Directory tenant.

1. Install the Azure Python SDK by running the command pip install azure-mgmt-resource.
2. Authenticate with Azure using your Azure account credentials. You can do this by using the ServicePrincipalCredentials class from the Azure Python SDK. Here’s an example:

from azure.common.credentials import ServicePrincipalCredentials

TENANT_ID = '<your tenant id>'
CLIENT_ID = '<your client id>'
CLIENT_SECRET = '<your client secret>'

credentials = ServicePrincipalCredentials(
    client_id=CLIENT_ID,
    secret=CLIENT_SECRET,
    tenant=TENANT_ID
)

3. Use the Azure Python SDK to list all the guest users in your Azure AD tenant. You can do this by using the GraphRbacManagementClient class from the Azure Python SDK. Here’s an example:

from azure.graphrbac import GraphRbacManagementClient
from azure.graphrbac.models import UserFilter

graph_client = GraphRbacManagementClient(credentials, TENANT_ID)

guest_users = graph_client.users.list(filter="userType eq 'Guest'")
for guest_user in guest_users:
    print(guest_user.userPrincipalName)

4. Use the Azure Python SDK to remove the guest users’ access to Azure resources. You can do this by using the RoleAssignmentsOperations class from the Azure Python SDK. Here’s an example:

from azure.mgmt.authorization import AuthorizationManagementClient

authorization_client = AuthorizationManagementClient(credentials, subscription_id)

for guest_user in guest_users:
    role_assignments = authorization_client.role_assignments.list_for_principal(
        guest_user.object_id,
        filter="atScope()",
        expand="roleDefinition"
    )
    for role_assignment in role_assignments:
        authorization_client.role_assignments.delete(
            role_assignment.scope,
            role_assignment.name
        )

# Example of a *compliant* Azure AD user managed by Terraform (member, not guest)
# SUBSTITUTE:
# - REPLACE_WITH_USER_PRINCIPAL_NAME: e.g. "alice@YOUR_TENANT.onmicrosoft.com"
# - REPLACE_WITH_DISPLAY_NAME: e.g. "Alice Example"

resource "azuread_user" "employee_account" {
  user_principal_name = "REPLACE_WITH_USER_PRINCIPAL_NAME"
  display_name        = "REPLACE_WITH_DISPLAY_NAME"

  mail_nickname   = "REPLACE_WITH_MAIL_NICKNAME"
  password        = "REPLACE_WITH_STRONG_PASSWORD"
  account_enabled = true
}

• Identify any guest accounts you are creating via Terraform, typically with azuread_invitation (or azuread_user resources whose underlying AAD object is a guest) and remove those resources from your configuration so they are no longer managed/created.
• If you want those identities as regular employees, model them as azuread_user resources like above in your employee onboarding module, and stop using invitations for them.

• Existing guest users you were managing (e.g. azuread_invitation or guest azuread_user resources you removed from code) should appear in the plan as - destroy.
• Only azuread_user resources representing internal/member users should be planned for + create or ~ update.