🛡️ Microsoft Entra ID Guest Invite Settings is not set to Only Users Assigned To Specific Admin Roles Can Invite Guest Users🟢

• Contextual name: 🛡️ Guest Invite Settings is not set to Only Users Assigned To Specific Admin Roles Can Invite Guest Users🟢
• ID: /ce/ca/azure/microsoft-entra-id/guest-invite-settings-only-admins-can-invite
• Tags:
  • 🟢 Policy with categories
  • 🟢 Policy with type
  • 🟢 Production policy
• Policy Type: COMPLIANCE_POLICY
• Policy Categories: SECURITY

Logic

• 🧠 prod.logic.yaml🟢
  • 📗 Azure Active Directory
  • 🔌 Azure Active Directory Auth Policy - object.extracts.yaml
  • 🧪 test-data.json

Similar Policies

• Cloud Conformity: Guests Can Invite

Description

Open File

Description

Restrict invitations to either users with specific administrative roles or no one.

Rationale

Restricting invitations to users with specific administrator roles ensures that only authorized accounts have access to cloud resources. This helps to maintain "Need to Know" permissions and prevents inadvertent access to data.

By default the setting Guest invite restrictions is set to Anyone in the organization can invite guest users including guests and non-admins. This would allow anyone within the organization to invite guests and non-admins to the tenant, posing a security risk.

Impact

With the option of Only users assigned to specific admin roles can invite guest users selected, users with specific admin roles will be in charge of sending invitations to the external users, requiring additional overhead by them to manage user accounts. This will mean coordinating with other departments as they are onboarding new users.

Audit

This policy marks an Azure Active Directory as INCOMPLIANT if the related Active Directory Auth Policy has Invites From State set to either:

... see more

Remediation

Open File

Remediation

From Azure Portal

1. From Azure Home select the Portal Menu.
2. Select Microsoft Entra ID.
3. Under Manage, select External Identities
4. Select External collaboration settings
5. Under Guest invite settings, set Guest invite restrictions to either Only users assigned to specific admin roles can invite guest users or No one in the organization [...]
6. Click Save

From Powershell

Enter the following:

Connect-MgGraph Update-MgPolicyAuthorizationPolicy -AllowInvitesFrom "adminsAndGuestInviters"

Alternatively, to set this to the most restrictive No one in the organization [...] enter the following:

Connect-MgGraph Update-MgPolicyAuthorizationPolicy -AllowInvitesFrom "none"

policy.yaml

Open File

Linked Framework Sections

Section	Sub Sections	Internal Rules	Policies	Flags	Compliance
💼 CIS Azure v5.0.0 → 💼 5.16 Ensure that 'Guest invite restrictions' is set to 'Only users assigned to specific admin roles [...]' or 'No one [..]' (Automated)			1		no data
💼 Cloudaware Framework → 💼 User Account Management			19		no data