Guest Sponsorship Coverage

The question it answers: Which enabled guests have no sponsor, or only sponsors who have left?

Every guest should have someone inside the organisation who is accountable for them - who answers the access review and says when the collaboration ends. Guests whose sponsors have all left are listed first, then guests that never had one.

Note

Entra sets the inviting user as sponsor for guests invited since 2023; older guests usually have none. Sponsors can be added in the Entra admin centre or with Graph (POST /users/{id}/sponsors/$ref).

At a glance

Where in the app	Entra ID › Identity Lifecycle › Guest Sponsorship
Workload	Entra ID
Kind	Table
Data	Built from the tenant data IntensiveReports keeps in memory and refreshes in the background, so it opens at once.
Licence	Microsoft Entra ID P1 for the sign-in activity column. The rest works without it.
Report id (API and MCP)	entra.lifecycle.guest-sponsorship

Columns

Column	Key	Type
Guest	DisplayName	Link
E-mail	Mail	Text
Finding	Finding	Status
Sponsors	Sponsors	Text
State	State	Text
Invited	Created	Date
Last sign-in	LastSignIn	Date

Filters

Filter	Key (API)	On when the page opens
Only enabled guests without an active sponsor	unsponsored	Yes

What it needs

Licence: Microsoft Entra ID P1 for the sign-in activity column. The rest works without it.

Application permissions on the IntensiveReports app registration (all permissions):

Permission	API	What it allows	Note
User.Read.All	Microsoft Graph	Read all users’ full profiles
User-LifeCycleInfo.Read.All	Microsoft Graph	Read all users’ lifecycle information

Data sources it reads

• GET /v1.0/users?$filter=userType eq 'Guest'&$expand=sponsors
• GET /v1.0/users (accountEnabled)
• GET /v1.0/users?$select=signInActivity

Through the API and MCP

GET /ir-api/v1/reports/entra.lifecycle.guest-sponsorship?size=100
GET /ir-api/v1/reports/entra.lifecycle.guest-sponsorship?filter=unsponsored

An AI assistant reads it with the MCP tool get_report and the id entra.lifecycle.guest-sponsorship. The client needs the Read grant for Entra ID. See Using the API.