📝 Microsoft Entra ID Guest Invite Settings is not set to Only Users Assigned To Specific Admin Roles Can Invite Guest Users 🟢

• Contextual name: 📝 Guest Invite Settings is not set to Only Users Assigned To Specific Admin Roles Can Invite Guest Users 🟢
• ID: /ce/ca/azure/microsoft-entra-id/guest-invite-settings-only-admins-can-invite
• Located in: 📁 Microsoft Entra ID

Flags

• 🟢 Policy with categories
• 🟢 Policy with type
• 🟢 Production policy

Our Metadata

• Policy Type: COMPLIANCE_POLICY
• Policy Category:
  • SECURITY

Similar Policies

• Cloud Conformity
  • Guests Can Invite

Logic

• 🧠 prod.logic.yaml 🟢
  • 📕 Azure Active Directory
  • 🔌 Azure Active Directory Auth Policy - object.extracts.yaml
  • 🧪 test-data.json

Description

Open File

Description

Restrict invitations to users with specific administrative roles only.

Rationale

Restricting invitations to users with specific administrator roles ensures that only authorized accounts have access to cloud resources. This helps to maintain "Need to Know" permissions and prevents inadvertent access to data.

By default the setting Guest invite restrictions is set to Anyone in the organization can invite guest users including guests and non-admins. This would allow anyone within the organization to invite guests and non-admins to the tenant, posing a security risk.

Impact

With the option of Only users assigned to specific admin roles can invite guest users selected, users with specific admin roles will be in charge of sending invitations to the external users, requiring additional overhead by them to manage user accounts. This will mean coordinating with other departments as they are onboarding new users.

Audit

From Azure Portal

1. From Azure Home select the Portal Menu.
2. Select Microsoft Entra ID.

... see more

Remediation

Open File

Remediation

From Azure Portal

1. From Azure Home select the Portal Menu.
2. Select Microsoft Entra ID.
3. Then External Identities.
4. Select External collaboration settings.
5. Under Guest invite settings, for Guest invite restrictions, ensure that Only users assigned to specific admin roles can invite guest users is selected.

policy.yaml

Open File

Linked Framework Sections

Section	Sub Sections	Internal Rules	Policies	Flags
💼 CIS Azure v2.1.0 → 💼 1.15 Ensure that 'Guest invite restrictions' is set to "Only users assigned to specific admin roles can invite guest users" - Level 2 (Manual)			1
💼 CIS Azure v3.0.0 → 💼 2.16 Ensure that 'Guest invite restrictions' is set to 'Only users assigned to specific admin roles can invite guest users' (Automated)			1
💼 Cloudaware Framework → 💼 User Account Management			14