Somebody needs a contractor in a team. Guest access is on in the Teams admin centre, the invitation either will not send or sends and achieves nothing, and there is no useful error either way. The reason this is hard to troubleshoot is that guest access is not a Teams feature with a Teams switch. It is an outcome that depends on four separate products agreeing.
First, confirm which feature you actually want
Guest access and external access are different things with similar names, and choosing the wrong one accounts for a fair share of the confusion. Guest access brings someone into a team as a member, with an account in your directory and access to the team's files and channels. External access lets your people find, chat with and meet people in other organisations without any of that.
If the requirement is a contractor working inside a team, that is guest access and the rest of this applies. If the requirement is chatting with someone at a client, external access is the simpler feature and none of the four layers below are involved.
The four layers, and the most restrictive one decides
Work down these in order. Each can independently prevent the outcome, and a permissive setting at one layer cannot rescue a restrictive one at another.
- Microsoft Entra ID external collaboration settings. Who in your organisation is permitted to invite guests at all, and whether the guest's domain is permitted. An allow list or deny list here is the most common hard stop.
Domain restrictions are the setting most likely to have been configured once and forgotten, and they fail per-domain rather than globally, so most invitations work and one does not.
- Microsoft 365 Groups guest settings. Whether group owners can add guests to groups. Every team has a group behind it, so a restriction here blocks team membership regardless of the Teams setting.
- Teams guest access. The organisation-wide toggle people find first, in the Teams admin centre.
- SharePoint external sharing. The team's files live in SharePoint, so external sharing settings decide whether a guest can do anything useful once they are in. A guest who joins a team and cannot open any document is usually this.
Invited successfully, and still nothing works
A different fault to the one above, and the settings are all fine. Two conditions produce it.
The first is time. After a guest is added to a team it can take up to 12 hours for access to be available. Turning on the tenant-level guest setting also does not take effect instantly. Testing five minutes after a change and concluding it failed is the single most common way to end up chasing a problem that was going to resolve itself.
The second is team membership. Guest functionality only becomes available to an account once it belongs to at least one team. A guest created through some other path, invited directly into the directory or added to a group without a team, is in a state where things fail confusingly. Adding them to a team is the fix, and it is not obvious from any error message.
Worth knowing as well: adding a guest straight to the Microsoft 365 group behind a team does grant them access to the team, but the group does not send an invitation email. The guest gets access and no notification, so somebody has to tell them.
Guests without a work account take a different route
A guest with a work or school account in Entra ID accepts the invitation and authenticates directly. Anyone else, which in practice means most consumer addresses, is validated with a one-time passcode instead. That path has to be available, and where it is not, invitations to personal addresses fail while invitations to corporate ones succeed. That pattern is diagnostic in itself.
Shared channels remove the dependency chain
Worth raising before spending a day on the four layers, because it sometimes makes the question go away. A shared channel lets you bring in people from outside the organisation without creating a guest account in your directory at all. Where the requirement is collaboration on one workstream rather than full membership of a team, it is a smaller change with fewer moving parts and less directory residue.
It is not a drop-in replacement. A shared channel participant is in that channel and not in the team, which is either exactly what you wanted or not enough, and that is a design decision rather than a troubleshooting step.
Do guests consume a licence?
Guest access works with Business Standard, Enterprise and Education subscriptions with no extra Microsoft 365 licence. Where a guest needs their own OneDrive storage or the ability to build a flow, that does require assigning them a licence.
Can I delegate guest invitations without making people administrators?
Yes. There is a Guest Inviter role for exactly this, which is the right answer when the reason invitations fail is that only administrators can send them.
A guest left the team and is still in our directory. Is that expected?
Yes. Leaving a team does not remove the guest account from the directory, and removing it is a separate administrative action. Access reviews are the maintainable way to handle this rather than doing it by hand.