The Tool Desk
Outbyte Driver Updater FREEFix the driver behind crashes, sound loss and screen glitchesFind Drivers →Outbyte PC Repair FREEClear out junk files and repair common Windows errorsFree Scan →Use a Microsoft Entra entitlement-management access package when access must end on a known date. Set the assignment to expire On date or after a defined number of days. The expiration removes access granted by that package. Pair it with recurring Access Reviews to verify continued need, automatically remove access when reviewers deny or do not respond, and clean up stale guest accounts. SharePoint’s guest-expiration setting is separate: it expires a guest’s sharing credential but does not disable or delete the directory account.
Which setting actually expires contractor or guest access?
For project-based external access, the clearest control is an access package in Microsoft Entra entitlement management. An access package bundles the resources a person needs—such as a group, application, or SharePoint site—with request rules, approvals, reviewers, and an assignment lifetime. When the assignment expires, access associated with that package ends without an administrator having to remember the project’s closing date.
As an Amazon Associate I earn from qualifying purchases.
During assignment-policy setup, choose an expiration of On date when the project has a firm end date. Choose a duration in days when the end date is uncertain but access should still be bounded. Microsoft’s current guidance recommends keeping external-access assignments to no more than 365 days unless the engagement is genuinely multiyear. A long-running engagement should still be reviewed periodically rather than left indefinite.
Expiration applies to the package assignment, not automatically to every permission the person may have. A guest can retain access through another package, a direct assignment, group membership, or a separate sharing link. Treat package expiration as one control in an offboarding system, then verify the user’s complete access scope.
#1 Best Overall
- Valued Carpenter Pencil Set: You will get 2 pcs solid carpenter pencils with 26 piece 2.8 mm refills, 1 replaceable sharpener, 1 plastic storage box.The complete carpenter pencils combination allows you to finish your work faster and more easily
- Deep Hole Marker Pencil: The deep-hole construction pencils adopts 45mm elongated tip design, which is more convenient to mark in the small hole or in other tight areas that other carpenter markers cannot reach
- Carpenter Pencils with Sharpener: The sharpener is screwed into the top of the work pencil, which won't get lost either. Built-in pencil sharpener that keep the lead with pointed and smooth to Improves line of sight in fine work
- Stronger Solid Lead: This work pencil is matched with a 2.8 mm thick lead , which is much thicker and stronger during the drawing process of construction work, it will not break or damage easily
- Marks on Various Surfaces: 3 colors solid construction pencil can marks on various surfaces,such as metal, plastic, wood, paper etc. Ideals for woodworkers, contractors, craftsmen, builders, merchants and masons
Build an access package for a project or engagement
1. Model the resource boundary
Start by defining what the contractor or guest is supposed to reach. Put the relevant group, application, site, or other governed resource in one package when the resources share the same owner and end date. Separating unrelated resources into different packages makes later expiration and review decisions easier to audit.
2. Define who can request access
Choose whether the package is available to people in your directory, to selected connected organizations, or only through an administrator. For external users, configure the allowed partner organization or invitation path and collect the information your reviewers need, such as company, project, and business sponsor.
3. Add approval and assignment rules
Specify whether approval is required, who can approve, and whether one or more approval stages are needed. Assign reviewers who can confirm the person still needs the resource. Set the assignment duration to an explicit end date or a number of days, and decide whether the assignee can extend access only by submitting a new request or an extension request.
4. Configure lifecycle behavior
In the package’s control configuration, select what should happen to an external user after package access expires. The package expiration removes the access tied to that assignment. If no other governed assignment remains, the lifecycle workflow can block sign-in and later remove the B2B guest account. Keep a separate directory offboarding procedure for accounts that have direct permissions or other access paths.
Rank #2
- Ergonomically Designed: Work in tight areas with a compact design that gets into tough spots
- Both tools are designed to fit into difficult to reach spaces
- Complete a wide range of applications with a high-performance motor that delivers up to 300 UWO, and an impact driver delivering up to 1,400 in-lbs of torque
- Both the DEWALT impact driver and drill driver feature integrated LED work lights with a convenient 20-second delay, ensuring enhanced visibility in dimly lit or challenging work areas
- One-Handed Loading - Keep one hand free with a 1/4 in. hex chuck that accepts 1 in. bit tips
5. Publish and test the package
Publish the package, assign it to a test guest, and use a short test duration in a nonproduction scope. Confirm that the expected group or application access disappears at expiration, that audit records show the assignment change, and that unrelated access is handled according to your separate policies.
Use Access Reviews to verify continued need
Expiration answers “when should this assignment end?” An Access Review answers “does this person still need it?” Create a recurring review for guest users and scope it to the relevant group, application, package, or an inactive-guest population.
Recommended review configuration
- Open Microsoft Entra ID and create an Access Review for the target group, application, access package, or selected guest users.
- Choose the reviewers. Resource owners are appropriate when they understand project membership; security or identity administrators may be better for broad stale-account reviews.
- Set a recurrence. Microsoft documents monthly, quarterly, twice-yearly, and annual schedules; for external access, quarterly or more frequent reviews provide the stronger operating cadence.
- Enable Auto apply results to resource so a completed decision changes the resource assignment instead of waiting for a separate administrator action.
- Set If reviewers don’t respond to Remove access. This prevents an unanswered review from silently extending access.
- Choose the action for denied guests. In the documented stale-guest workflow, select Block user from signing in for 30 days, then remove user from the tenant when that option is available to your tenant and review scope.
Record the business owner, review scope, recurrence, decision, and applied result. These records provide governance evidence that access was periodically attested rather than merely granted once and forgotten.
What’s actually slowing this PC down?
Pick the symptom - the matching free tool is one click away.
Automatically clean up inactive guest users
Inactive-user cleanup is different from a project end date. It catches people who were never formally offboarded or who stopped signing in before their assignment was reviewed. Configure an Access Review for inactive guest users and set the inactivity threshold that matches your risk tolerance and engagement pattern.
Rank #3
- 【Great Compatibility】This Katerk 1/4 inch hex shank bit holder is specifically designed for 1/4 inch hex shank drill bits. It's compatible with most 1/4 fast hex handles, hex sockets, various electric screwdrivers, and handheld screwdrivers. The bit holder makes it a valuable addition for any handyman.
- 【Secure and Safe】Built with a secure backup nut design, each drill bit holder securely locks onto your bits, ensuring they stay firmly in place. Additionally, our bit holder incorporates a high-quality steel ball rolling design that holds up to several kilograms of weight, ensuring your various drill bits don't fall off.
- 【Easy One-Handed Operation】The bit holder for impact driver allows you to change bits single-handedly, simplifying your workflow. Its multi-color design further allows for quick identification of the drill bit you need.
- 【Compact and Convenient】Thanks to its compact size, this 1/4 inch bit holder is easy to carry around. The bit holder allows for easy attachment to various tools, making this a convenient addition to your construction accessories. The Katerk bit holder is cast from high-quality alloy material, promising a long product lifespan. Despite its rugged strength, the bit holder remains lightweight, making it portable.
- 【Cool Christmas Gift For Men Stocking Stuffers】 This screwdriver bit holder, driver bit holder, impact bit holder, can be given as a gift to your loved one, especially for anyone involved in construction or electrical work. It's a must-have for stocking stuffers for men and women, tools gifts for dad, tech gadgets for men, gifts for dad, gifts for him, gifts for husband, gifts for boyfriend, cool gadgets for men, and cool gifts for dad.
How the inactive-user workflow behaves
- Guests who have not signed in for the configured number of days appear in the review population.
- Reviewers can approve continued access or deny it based on current business need.
- With auto-apply enabled, denied assignments are removed from the selected resource.
- When the documented block-then-delete action is selected, a denied or stale guest is blocked from signing in for 30 days and then deleted from the tenant.
Before enabling deletion, check for a replacement owner, legal-retention requirement, active investigations, or another package that still represents a valid engagement. Deleting the guest object does not erase the need to remove permissions granted outside the review scope.
Expiration, reviews, and account deletion compared
| Control | Primary trigger | Typical scope | Governance result | What it does not prove |
|---|---|---|---|---|
| Access-package assignment expiration | Fixed end date or elapsed duration | Resources included in one package assignment | Removes package-associated access at the end of the assignment | That all direct, group-based, or separately shared permissions are gone |
| Recurring Access Review | Schedule plus reviewer decision or no response | Group, application, package, or selected guests | Applies approval or removal decisions and preserves review history | That resources outside the selected scope were evaluated |
| Inactive-guest review | No sign-in for the configured threshold | Guests meeting the inactivity condition | Can remove access, block sign-in, and use the documented deletion workflow | That a user is unnecessary merely because sign-in is infrequent |
| SharePoint guest expiration | SharePoint sharing-credential lifetime | A guest’s SharePoint sharing access | Expires the credential used for that sharing relationship | That the Microsoft Entra or Active Directory account was disabled or deleted |
SharePoint guest expiration is not directory offboarding
SharePoint has a guest-expiration control for sharing credentials. It is useful when a site owner wants a guest’s sharing relationship to age out, but Microsoft explicitly distinguishes guest expiration from disabling or removing an account in Active Directory. A person may therefore lose the SharePoint credential while the guest object remains present and potentially usable elsewhere.
Use SharePoint expiration alongside, not instead of, Entra package assignments, Access Reviews, and directory offboarding. When a contractor leaves, revoke package and direct assignments, remove group membership, invalidate separate sharing paths, and then apply your tenant’s account-blocking or deletion process.
Licensing and rollout requirements
The Microsoft documentation for guest Access Reviews lists Microsoft Entra ID P2 or Microsoft Entra ID Governance as prerequisites. Confirm that the tenant has the required licensing for every population you plan to review, including external users and inactive-guest workflows. Portal labels, available lifecycle actions, and partner-organization features can vary by tenant configuration and may change, so validate them in the current admin center before production rollout.
Rank #4
- Long Nib and Deep Hole Marker: Our mechanical carpenter pencil with 45mm nib is designed for easy marking of deep holes or narrow areas. These construction pencils are the great choice for woodworking tools, construction tools, carpenter tools, contractor tools, wood carpentry tools and architect tools
- Extra Refills in 2 Colors for Versatile Marking: The construction mechanical pencil comes with 12 extra 2.8mm refills, including 6 red and 6 black refills. The black refill is suitable for light surfaces, while the red wax is perfect for dark surfaces. Our carpenter mechanical pencil makes sure that you'll have an ample supply for extended use
- Built-in Sharpener: Our construction pencil comes with a built-in sharpener to ensure the mechanical pencil tip is always sharp and ready for use. Never buy an extra pencil sharpener again. A great tool for any woodworker pencil, contractor pencils. The refill can easily be extended or retracted with a simple click of the pencils mechanical, allowing you to work more efficiently and accurately
- Portable Clip Design: Our deep hole construction pencil features a portable clip design, easy to carry and attach to your pocket or tool box, so that you can keep the carpenter pencils mechanical close at hand, making it a convenient tool to have on the go. Great gifts choice for carpenters
- Stronger Pencil Lead: The black refills are made of lead, sturdy and smooth. The red refills are made of wax, clear and light. These marking pencils are much thicker and stronger than normal pencils during the marking process of construction work, suitable for various surfaces, such as glasses, metal, boards, floors, walls, furniture, etc. The written marks can be easily wiped with a wet paper towel when needed
- Assign an owner for each package and resource.
- Document the business purpose, allowed population, approval chain, and expiration rule.
- Decide how direct assignments and group memberships will be discovered during offboarding.
- Set a review schedule that is at least quarterly for packages carrying external access unless a stricter cadence is warranted.
- Test expiration, denial, no-response handling, sign-in blocking, and deletion in a controlled scope.
- Keep audit records and an exception process for approved multiyear projects.
Common failure modes and fixes
The guest still has access after the package expired
Check every assignment and permission path. Look for another access package, a direct application or group assignment, nested group membership, or a separate SharePoint sharing link. Expiration removed only the access associated with the expired package.
The review completed but access did not change
Verify that Auto apply results to resource was enabled and that the review targeted the correct group, application, or package. Confirm that the reviewer’s decision was recorded and that the resource supports the selected removal action.
No-response users remained active
Open the review settings and check If reviewers don’t respond. It must be set to Remove access if unanswered reviews are supposed to revoke access. Also verify that the review reached its end date and that results were applied.
A guest was blocked but not deleted
The block-then-delete workflow includes a 30-day block period. Check whether that period has elapsed, whether another assignment keeps the account in use, and whether tenant policy or licensing allows the deletion action. Investigate holds and exceptions before manually deleting the object.
Best Value
- Milwaukee Ink all Fine Point Marker, Black, 4 Per Pack
- 4 per pack Features Clog Resistant Marker Tip Writes through Dusty, Wet and Oily Surfaces Durable Marker Tip for Writing on Concrete, OSB and Rough Surfaces
- Clog resistant tip writes on dusty, wet and oily surfaces and is optimized for rough surfaces such as OSB, cinderblock and concrete
- Hard hat clip- attaches for easy access
- Quick dry time with reduced smearing and marking
The expiration option is missing
Confirm that you are editing an entitlement-management assignment policy rather than a basic invitation or sharing setting. Check role permissions, licensing, tenant configuration, and the current portal experience. SharePoint’s credential-expiration setting will not provide an access-package lifetime.
A practical operating pattern
For a contractor joining a six-month project, create one package containing the project group and applications, require sponsor approval, and assign an end date matching the statement of work. Schedule a recurring review for the package or project group. If the engagement is extended, the sponsor submits an extension or new request rather than silently changing a permanent group membership. When the end date arrives, package access ends; the review and directory process then identify any remaining access outside that package.
For a guest who has stopped signing in, include the account in the inactive-guest review population. Let the reviewer decide whether the inactivity is expected, such as a quarterly consultant or an emergency contact, or whether access should be removed. Apply the result automatically and use the documented sign-in block and deletion sequence for denied stale guests.
Free tools Windows power users keep installed
One-click scans. No signup required.
Quick Recap
Key implementation decisions
- Use an access-package expiration for a known project or contract end.
- Use recurring Access Reviews for continued-need confirmation and accountability.
- Use inactivity-based reviews to find guests who bypassed formal offboarding.
- Set unanswered reviews to remove access when the risk of silent retention is unacceptable.
- Remember that package expiration and SharePoint credential expiration do not guarantee directory deletion.
- Audit all assignments and sharing paths before declaring a guest fully offboarded.
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
