Fix Teams Guest Access Is Enabled but Guests Cannot Join for a Security Group

You enabled guest access in Teams, but external users in a specific security group still cannot join your team or channel. The cause is usually a mismatch between the security group membership and the guest access settings in Microsoft Entra ID or Teams admin center. This article explains the root cause and gives step-by-step fixes to resolve the issue.

Guest access in Teams depends on several layers: Microsoft Entra ID external identities settings, Teams guest access policies, and the security group that grants or denies guest permissions. When one of these layers blocks the guest, the join fails even though the global switch appears enabled.

You will learn how to diagnose the exact blocking layer and apply the correct fix. The steps cover Microsoft Entra ID, Teams admin center, and security group membership checks.

Why Guest Access Fails for a Security Group Despite Being Enabled

Guest access in Teams is not a single switch. It is a chain of settings that must all allow the guest. When you enable guest access globally, that only turns on the capability. The actual join permission is enforced by several policies that can override the global setting.

The most common reason a security group cannot join is that the guest is not a member of that group. Even if the group has been granted guest access, the guest must be explicitly added as a member. If the guest was invited but never added to the group, the join fails.

Another common cause is the guest invite restriction in Microsoft Entra ID. The setting Guests can invite or Collaboration restrictions can be configured to allow only specific groups to invite guests. If the security group is not listed as an allowed group, the guest cannot be invited or join.

Finally, the Teams guest access policy might have a domain restriction. If the guest’s email domain is not in the allowed domain list, the guest is blocked at the Teams level even if the global switch is on.

The Role of Security Groups in Guest Access

Security groups in Teams are used to control who can be a guest in a specific team. When you configure guest access for a team, you can assign a security group that defines which external users are allowed. This group must contain the guest’s user object as a member.

If the group is empty or the guest is not a member, the join request is denied. The error message often says “You don’t have access” or “Your administrator has not allowed guest access.”

Steps to Diagnose and Fix Guest Access for a Security Group

Follow these steps in order. Each step verifies one layer of the access chain.

1. Check the guest’s membership in the security group
   Open Microsoft Entra admin center. Go to Groups > All groups. Find the security group that is supposed to allow guest access. Open the group and select Members. Confirm that the guest’s email address appears in the list. If not, add the guest using Add member. Wait up to 30 minutes for replication.
2. Verify Microsoft Entra ID external collaboration settings
   In Microsoft Entra admin center, go to External Identities > External collaboration settings. Under Guest invite restrictions, ensure that the option Anyone in the organization can invite guest users including guests and non-admins is selected. If the setting is Only users assigned to specific admin roles can invite guest users, the security group may be blocked. Change the setting or add the group to the allowed list.
3. Confirm the guest access toggle in Teams admin center
   Open Teams admin center. Go to Users > Guest users. Ensure that Allow guest access in Microsoft Teams is set to On. Also check Allow guest access to specific domains. Add the guest’s email domain to the allowed list if it is missing.
4. Check the guest access policy for the team
   In Teams admin center, go to Meetings > Meeting policies or Teams > Teams policies. Find the policy assigned to the team or to the guest. Ensure that Allow guest access is set to On. If the policy is set to Off, the guest cannot join even if the global setting is on.
5. Use PowerShell to verify group membership
   Install the Microsoft Graph PowerShell module. Run Connect-MgGraph -Scopes "Group.Read.All". Then run Get-MgGroupMember -GroupId "group-id" to list all members. Confirm the guest’s object ID is in the output. If not, add the guest using Add-MgGroupMember.
6. Clear the guest’s cached credentials
   Have the guest sign out of Teams and all Microsoft 365 apps. Then sign in again. Cached permissions can block the new group membership from taking effect.
7. Test with a different guest account
   Create a new guest account from a different domain and add it to the same security group. If that guest can join, the issue is specific to the original guest’s account or domain. If it cannot join, the problem is in the policy settings.

If the Fix Does Not Work, Check the Team’s Guest Permissions

Open the team in Teams. Select More options (…) next to the team name. Choose Manage team. Go to Settings and check Guest permissions. Ensure that Allow guests to create and update channels is enabled if the guest needs to join a channel. If this is off, the guest can see the team but cannot join the channel.

If Guests Still Cannot Join After the Main Fix

Guest Receives “You Don’t Have Access” Error

This error usually means the guest is not a member of the security group. Recheck the group membership in Microsoft Entra ID. Also check if the group is a distribution group instead of a security group. Distribution groups do not grant access permissions.

Guest Can Join Some Teams but Not Others

This indicates that the team or the channel has a separate guest policy. Check the team’s Guest permissions settings. Also check the channel’s Moderation settings. If moderation is enabled, the guest may need to be added as a moderator.

Guest Access Works on the Web but Not in the Desktop App

This is often a client cache issue. Have the guest clear the Teams cache by deleting the folder %appdata%\Microsoft\Teams. Then restart Teams. Also ensure the desktop app is updated to the latest version.

Guest Access Enabled vs Security Group Membership: Key Differences

Item	Guest Access Enabled	Security Group Membership
Purpose	Global switch that allows external users in Teams	Specific list of external users allowed to join a team
Where to Configure	Teams admin center > Users > Guest users	Microsoft Entra ID > Groups
Effect	Allows guest access for all teams	Restricts access to only those in the group
Common Failure	Global switch is on but domain block	Guest not added as a member

Now you know the exact layers that control guest access for a security group. Check the Microsoft Entra ID external collaboration settings first, then the Teams guest access toggle, and finally the group membership itself. Use the PowerShell command to verify membership quickly.

After applying the fix, test with a fresh guest account to confirm the policies are correct. Remember that changes can take up to 30 minutes to propagate. For advanced troubleshooting, use the Teams Call Quality Dashboard to check sign-in logs and identify the exact error code.