When a Guest user loses access to SharePoint sites or business applications after a tenant-to-tenant migration, do not immediately delete and recreate the guest account.
Instead, try resetting the guest user’s redemption status in Microsoft Entra.
Resetting the redemption status allows the user to accept a new invitation using their account from the new home tenant. More importantly, the existing guest object is retained, including its:
- Object ID
- Group memberships
- Enterprise application assignments
- Existing access relationships
This can restore access without reconfiguring SharePoint permissions or application assignments.
In this blog, we will focus on guest access after a tenant-to-tenant migration and highlight the key considerations for ensuring users can continue accessing shared applications and resources from resource tenant.
The same approach can also be used when a user account is permanently deleted and recreated in the home tenant, while the existing guest account and its resource permissions remain in the resource tenant.
Why is this needed after a tenant migration?
During a tenant-to-tenant migration, a user may keep the same email address and domain name.
For example, the user might continue signing in as:
user@company.comAlthough the email address remains unchanged, the user account is now hosted in a different Microsoft Entra tenant.
This means the identity behind the email address has changed.
The guest account in the external resource tenant was originally redeemed using the user’s old home-tenant identity. After migration, the user signs in using a newly created identity from the new tenant.
The email address may look the same, but Microsoft Entra now sees a different home-tenant identity.
As a result, the user may receive an error similar to:
The selected user account does not exist in this tenant and cannot access the application. The account needs to be added as an external user in the tenant first.
The guest account may still be visible in Microsoft Entra, and its invitation status may still show as accepted. However, the existing redemption is linked to the user’s previous identity.
My recent tenant migration experience
I recently faced this issue after migrating users from one Microsoft 365 tenant to another.
The user had already been invited as a guest to a resource tenant and had access to:
- SharePoint sites
- Enterprise applications
- Security groups
- Azure resources
- Other business resources
The tenant migration completed successfully, and the user could access services in the new tenant. However, the user could no longer access resources shared from the resource tenant.
The user’s email address remained the same, and the existing guest account was still present.
Sending another invitation did not solve the problem because the existing guest invitation had already been redeemed using the old identity.
Instead of deleting the guest account, we reset its redemption status. The user then accepted the new invitation using the account from the new home tenant.
After completing the redemption, the user regained access without making changes to the existing SharePoint permissions or application assignments.
Why not delete and recreate the guest?
Deleting the guest account might appear to be an easy solution, but it can create additional work and access issues.
When a guest account is deleted and recreated, the new account normally receives a new object ID.
Even when the display name and email address are identical, Microsoft Entra and connected applications may treat the recreated account as a completely different user.
The existing guest account may already have access through:
- Direct SharePoint permissions
- SharePoint groups
- Microsoft 365 groups
- Security groups
- Enterprise application assignments
- Application roles
- Azure role assignments
- Access packages
Recreating all these permissions can be time-consuming. Some access relationships may also be missed during the recreation process.
Resetting redemption is safer because it keeps the existing guest object and reconnects it to the user’s current identity.
What happens when redemption is reset?
Resetting the redemption status does not create a new guest account.
Instead, Microsoft Entra:
- Keeps the existing guest object.
- Changes the invitation status so the invitation can be redeemed again.
- Sends a new invitation to the user.
- Allows the user to sign in using the new identity.
- Retains the guest user’s existing object ID, group memberships, and application assignments.
The guest user principal name in the resource tenant also remains unchanged. However, the user’s sign-in identity is updated when the new invitation is redeemed.
When should you use reset redemption?
Resetting the redemption status can be useful when:
- A guest user has moved to a new Microsoft Entra tenant.
- A company has completed a tenant-to-tenant migration.
- The user’s account was deleted and recreated in their home tenant.
- The user has moved to another company but still needs the same resource access.
- The user needs to sign in using a different email address.
- The guest user’s external identity provider has changed.
The main requirement is simple: you need to preserve the existing guest object while allowing the user to redeem the invitation again.
Roles required for Reset Guest Redemption Status
To reset a guest user’s redemption status, the administrator needs one of the following Microsoft Entra roles at directory scope:
- Helpdesk Administrator
- User Administrator
Helpdesk Administrator is the least-privileged role for this task.
Validating Guest Access Experience
Before making any changes to the user account in the home tenant, we will first sign in and confirm that the user can access the existing SharePoint and Azure resources in the resource tenant.
For this test, we are not migrating the user to another tenant. Instead, we will permanently delete the user account from the home tenant, recreate it with the same details, and then test whether the user can still access the resources through the existing guest account in the resource tenant.
Let us first validate that the home tenant user, James Paul, can access the SharePoint sites and Azure resources in the resource tenant and confirm his existing group memberships.
Now, let us review and validate the guest account in the resource tenant.
Now, let us confirm the SharePoint and Azure access assigned to the same user in the resource tenant.
Now, let us validate guest access by signing in with the James Paul account.
SharePoint Site Access using Guest Account
The Guest user James Paul able access the SharePoint site.
Azure resources Access using Guest account
To access Azure resources hosted in another tenant, the user must first switch to the appropriate directory, as shown in the screenshot below.
After switching to the resource tenant, you should be able to see the Azure subscription that has been assigned to the guest user.
Now, let us permanently delete the user account from the home tenant, recreate a new account using the same email address, and then verify how the existing guest access behaves.
Permanently deleting the user account from the Microsoft Entra admin center.
After permanently deleting the original account, we created a new user in the home tenant using the same email address and completed the required setup, including MFA registration.
At this stage, no changes have been made in the resource tenant. The original guest account still exists with all its SharePoint, Azure, and group memberships intact. Let us now try accessing the SharePoint site and Azure resources to see how the existing guest account behaves.
Note: If Cross-Tenant Synchronization is configured between the home and resource tenants, the guest account in the resource tenant may be automatically deleted based on your synchronization settings. In such cases, you should restore the deleted guest account in the resource tenant before synchronizing the newly created user. This preserves the existing permissions and allows you to perform the required guest redemption reset to regain access.
Testing Resource Tenant SharePoint Access with the Newly Created User Account
When we try to access the SharePoint site, which still has permissions assigned to the existing guest account, access fails with an error indicating that the selected user account no longer exists in the resource tenant. This occurs because the guest account is still linked to the identity of the previously deleted home tenant user, even though a new user has been created with the same email address.
Testing Resource Tenant Azure Resource Access with the Newly Created User Account
When we try to access Azure resources, the resource tenant directory is no longer listed for the newly created user. As a result, the user cannot switch to the resource tenant from the Azure portal.
Reset redemption from the Microsoft Entra admin center
Complete the following steps in the tenant where the guest account and shared resources are located.
Step 1: Find the existing guest account
Sign in to the Microsoft Entra admin center. Go to Entra ID.Select Users. Search for the guest user. Open the guest user’s profile.
Before making any changes, record the guest user’s object ID. You can use it later to confirm that the same object was retained.
Step 2: Review the user’s email address
Check the following properties:
- User principal name
- Other emails
- User type
- External user state
If the user’s email address changed during migration\reconfiguration, update the Email property and add the new address under Other emails.
When the domain and email address remain the same, this change may not be required.
Step 3: Reset the redemption status
From the guest user’s profile:
Open the Overview page. Find the B2B Invitation section under My Feed.Select Reset redemption status. Review the confirmation message. Select Reset.
Microsoft Entra will reset the invitation status and send a new invitation while keeping the guest object.
Within a few seconds, you'll see a confirmation message indicating that the user has been successfully invited.
Step 4: Ask the user to accept the invitation
Ask the user to open the new invitation and sign in using the account from their home tenant.
For the first attempt(If you did the user T2T Migration), I recommend using an InPrivate or Incognito browser window. This prevents the browser from automatically selecting a cached account from the previous tenant.
After accepting the invitation, let's verify whether any changes have been made to the guest account in the Microsoft Entra admin center of the resource tenant. We will also validate that the user can once again access the SharePoint sites and Azure resources using the same guest account.
As shown in the screenshot above, no changes have been made to the guest account except that the External user state change date and time have been updated. All existing attributes, group memberships, SharePoint permissions, and Azure RBAC assignments remain unchanged.
SharePoint Access Validation
As shown below, the user can now successfully access the SharePoint site in the resource tenant after resetting the guest invitation. Since the existing guest account was retained, all previously assigned SharePoint permissions continued to work without requiring any changes to site permissions or group memberships.
Azure Resource Validation
As shown below, the resource tenant now appears again in the Switch directory menu. After switching to the resource tenant, the user can successfully access the Azure resources that were previously assigned to the existing guest account, without requiring any changes to Azure RBAC assignments or group memberships.
Reset redemption using Microsoft Graph PowerShell
PowerShell can be useful when you need to reset multiple guest users or maintain an administrative record of the changes.
Install-Module Microsoft.Graph -Scope CurrentUser
Connect-MgGraph -Scopes "User.Invite.All","User.ReadWrite.All"
$user = Get-MgUser -Filter "startsWith(mail, 'james.paul@domain.com')"
New-MgInvitation -InvitedUserEmailAddress $user.Mail -InviteRedirectUrl "https://myapps.microsoft.com" -ResetRedemption -SendInvitationMessage -InvitedUser $user
Important limitation: Multitenant Organization
There is an important limitation when Microsoft Entra Multitenant Organization(MTO), is enabled.Reset redemption for an already redeemed B2B user is currently not supported when the user is part of a Multitenant Organization. This means the reset operation will fail while the tenant relationship is managed through MTO.
In such cases, the relevant MTO relationship had to be removed before we could reset the guest user’s redemption status.
After removing the MTO relationship, we were able to: Reset the guest redemption status.
Send a new invitation.
Troubleshooting after the reset
If the user still cannot access the resource after accepting the new invitation, check the following areas.
Confirm the correct account was used
Ask the user to sign out from all Microsoft accounts and test again using an InPrivate browser window.
Make sure the user selects the account from the new home tenant(If you sign after T2T Migration).
Review the sign-in logs
Check the user’s sign-in logs in the resource tenant.
Look for:
- Conditional Access failures
- MFA requirements
- Device compliance requirements
- Authentication strength failures
- Cross-tenant access restrictions
Check for duplicate guest accounts
Search using:
- The user’s current email address
- The previous email address
- The guest
#EXT#UPN - The display name
- Deleted users
Multiple guest objects with similar names can cause permissions to be assigned to the wrong account.
Verify the application assignment
Confirm that the application or SharePoint site is still using the preserved guest object.
Some custom applications may store their own identity references outside Microsoft Entra. These applications may require additional validation even when the Microsoft Entra object ID remains unchanged.
Include external guest access in migration planning
Tenant-to-tenant migration planning should not focus only on mailboxes, OneDrive, Teams, licenses, and devices.
A user may also have guest access to:
- Customer tenants
- Partner tenants
- Supplier portals
- Shared SharePoint sites
- Enterprise applications
- Azure subscriptions
- Power BI reports
- Internal business applications
Final thoughts
A guest user can lose access when their original account is migrated, deleted and recreated, linked to a different identity provider, or changed to a new email address.
Before deleting the existing guest account, reset its redemption status. This allows the user to redeem a new invitation while preserving the existing guest object, permissions, group memberships, and application assignments.
Also check Multitenant Organization membership, as reset redemption is not available for an already redeemed B2B user while the related MTO configuration is active.
0 Comments