When you run a SharePoint sharing report, you might see entries labeled as “Unknown User” instead of a person’s name or email address. This problem occurs because the sharing report cannot resolve the identity of a user who accepted an external sharing invitation but is not yet synchronized into your Microsoft 365 directory. This article explains why the report shows unknown users and provides step-by-step methods to identify those users and fix the resolution issue.
Key Takeaways: Resolving Unknown Users in SharePoint Sharing Reports
- SharePoint admin center > Sharing reports: Shows external users but may list them as “Unknown User” if their identity is not synced to Azure AD.
- Azure AD > External Identities > All guests: Lists all guest users; you can match invitation email addresses to find the unknown user.
- SharePoint Online Management Shell: Use the
Get-SPOExternalUsercmdlet to retrieve the actual email address and display name for an unknown user.
Why the Sharing Report Shows Unknown Users
The SharePoint sharing report pulls user identity data from your Azure Active Directory. When an external user accepts a sharing invitation, SharePoint creates a guest user object in Azure AD. However, if the guest user object does not have a resolved display name or if the user was deleted from Azure AD after accepting the invitation, the report falls back to the string “Unknown User.”
This situation typically happens in two scenarios. First, the external user accepted the invitation using a Microsoft account that differs from the email address you sent the invitation to. Second, the guest user was removed from Azure AD through manual cleanup or an automated lifecycle policy, but the sharing record still exists in SharePoint.
How the Sharing Report Collects Data
The SharePoint sharing report queries the Unified Audit Log for sharing events. Each event records the target user’s email address and a user ID. The report then tries to match that user ID against Azure AD guest objects. If no match exists, the display name field shows “Unknown User.” The email address field may also be blank if the audit log entry was incomplete.
Steps to Identify and Fix Unknown Users in the Sharing Report
Use the following methods to determine who the unknown user is and to restore visibility in future reports.
- Open the SharePoint Sharing Report
Go to the SharePoint admin center. Select Reports from the left navigation, then choose Sharing reports. Click Run report and select a date range. After the report generates, download the CSV file. - Locate Unknown User Entries in the CSV
Open the CSV file in Excel or a text editor. Look for rows where the Display Name column contains “Unknown User.” Note the User Email column — it may be blank or contain an email address. If the email is present, copy it. - Search for the Guest User in Azure AD
Open the Azure AD admin center at https://aad.portal.azure.com. Go to External Identities and select All guest users. In the search box, paste the email address from step 2. If you find the guest user, note the User principal name (UPN). If the UPN is different from the email you searched, the user accepted the invitation with a different Microsoft account. - Use SharePoint Online Management Shell to Get External User Details
If you cannot find the user in Azure AD, use PowerShell. Install the SharePoint Online Management Shell if you have not done so. RunConnect-SPOService -Url https://yourtenant-admin.sharepoint.com. Then runGet-SPOExternalUser | Where-Object {$_.AcceptedAs -eq "unknownuser@domain.com"}replacing the email with the value from the report. This cmdlet returns the actual email and display name for that external user. - Reinvite the User If Needed
If the external user no longer has a guest account in Azure AD, you must reinvite them. Go to the site where the sharing was originally granted. Remove the user from the site permissions. Then add the user again using their correct email address. The new sharing event will create a fresh guest object in Azure AD, and future reports will show the correct name. - Regenerate the Sharing Report
After completing the steps above, run the sharing report again for the same date range. The report should now display the correct display name for the previously unknown user. If it still shows “Unknown User,” repeat the PowerShell step to verify the user exists in Azure AD with a resolved name.
If Unknown Users Persist After the Main Fix
Sharing Report Shows Unknown User for a User Who Was Deleted
If the external user was permanently deleted from Azure AD, the report will always show “Unknown User” for past events. You cannot retroactively fix historical report entries. To prevent this from happening again, set a longer guest user retention policy in Azure AD. Go to Azure AD > External Identities > Guest user access and adjust the Guest user expiration setting to a higher number of days.
Sharing Report Shows Unknown User for Internal Users
In rare cases, the sharing report may show “Unknown User” for a user within your organization. This happens when the user was deleted from Azure AD but still had active sharing permissions. To fix this, restore the user from the Azure AD deleted users list. Go to Azure AD > Users > Deleted users, select the user, and click Restore user. After restoration, run the sharing report again.
Sharing Report Shows No Email Address for an Unknown User
If the CSV shows a blank email address for an unknown user, you cannot identify them through Azure AD or PowerShell. This occurs when the audit log entry was truncated. The only workaround is to review site permissions for all external users. Go to each site that has external sharing enabled, go to Settings > Site permissions, and review the list of external users. Remove any users you do not recognize.
Sharing Report Data Sources: Unknown User Resolution Comparison
| Data Source | Shows Display Name | Shows Email Address | Can Be Fixed Retroactively |
|---|---|---|---|
| SharePoint Sharing Report (CSV) | No — shows “Unknown User” | Sometimes — may be blank | No — historical data cannot be updated |
| Azure AD Guest Users List | Yes — if user exists | Yes — UPN is shown | N/A — this is a live directory |
| SharePoint Online PowerShell Get-SPOExternalUser | Yes — returns actual display name | Yes — returns email address | N/A — this is a live query |
The SharePoint sharing report is a point-in-time snapshot. Once an external user is deleted from Azure AD, you cannot recover the display name for past reports. To minimize future unknown user entries, configure a guest user expiration policy in Azure AD and run regular PowerShell scripts to verify that all external guest accounts still have a valid display name. Use the Get-SPOExternalUser cmdlet monthly to export a list of external users and compare it against the Azure AD guest list. This proactive check ensures that when you run a sharing report, every user has a resolved identity.