The NHS Wales Microsoft 365 Centre of Excellence, in agreement with Welsh Health Boards, Special Health Authorities and NHS Trusts, are utilising a review system for anyone using NHS Wales Microsoft 365 services via guest access

 

What is a guest user?

Someone who is granted access from an external organisation (e.g. does not have a @wales.nhs.uk email address) to collaborate with NHS Wales staff across Microsoft 365 resources such as Microsoft Teams, Microsoft PowerBI Dashboards or Microsoft SharePoint (documents).

 

Why have I received an email asking me to review my access?

You have been granted access to the NHS Wales M365 platform as a guest user and will therefore be required to confirm your continued need for access. Someone from within NHS Wales from a Health Board, Trust or Special Authority has invited you to collaborate via the applications above or to view documents/information/data within the NHS Wales system. They are known as your Sponsor.

 

Why should I trust the email?

You will have received the email from the official Microsoft email address (MSSecurity-noreply@microsoft.com) and it will look like this:

You can learn more about reviewing your own access through this support page from Microsoft: Review your own access by using My Access

The email will also contain the NHS Wales logo and a message asking you to visit the URL for this information page on the NHS Wales website.

When you click the “Review access” button, it will prompt you to sign into the NHS Wales M365 platform to complete your review.

 

What happens in the review process?

You will receive an email every 90 days to confirm that you still require access to the NHS Wales M365 platform, including a timeframe to complete the review. There will be a “Review access” button in the email which opens this page:

Confirm whether you still need access with “yes” or “no”.

 

What happens if I confirm that I need access?

If you selected “yes”, your access would remain unaffected, and you can continue to collaborate with your Sponsor or view shared information.

 

What happens if I confirm I no longer need access?

If you respond "no", your guest account will be automatically disabled and permanently deleted 30 days later.

 

What happens if I don’t respond?

If you do not complete the review within the timeframe specified in the email from MSSecurity, your guest account will be automatically disabled and permanently deleted 30 days later.

If this is a mistake and you do need guest user access, you will need to contact your Sponsor to complete the invitation process again. You would be supplied with a fresh account and the Sponsor would need to share any resources again. 

 

What should I do if I have questions?

Please contact your Sponsor and if there are any issues, they will need to contact their local NHS ICT or Digital Team for guidance.