🛡️ Microsoft Entra ID Guest Invite Settings is not set to Only Users Assigned To Specific Admin Roles Can Invite Guest Users🟢

• Contextual name: 🛡️ Guest Invite Settings is not set to Only Users Assigned To Specific Admin Roles Can Invite Guest Users🟢
• ID: /ce/ca/azure/microsoft-entra-id/guest-invite-settings-only-admins-can-invite
• Tags:
  • 🟢 Policy with categories
  • 🟢 Policy with type
  • 🟢 Production policy
• Policy Type: COMPLIANCE_POLICY
• Policy Categories: SECURITY

Logic

• 🧠 prod.logic.yaml🟢
  • 📗 Azure Active Directory
  • 🔌 Azure Active Directory Auth Policy - object.extracts.yaml
  • 🧪 test-data.json

Similar Policies

• Cloud Conformity: Guests Can Invite

Description

Open File

Description

Restrict invitations to users with specific administrative roles only.

Rationale

Restricting invitations to users with specific administrator roles ensures that only authorized accounts have access to cloud resources. This helps to maintain "Need to Know" permissions and prevents inadvertent access to data.

By default the setting Guest invite restrictions is set to Anyone in the organization can invite guest users including guests and non-admins. This would allow anyone within the organization to invite guests and non-admins to the tenant, posing a security risk.

Impact

With the option of Only users assigned to specific admin roles can invite guest users selected, users with specific admin roles will be in charge of sending invitations to the external users, requiring additional overhead by them to manage user accounts. This will mean coordinating with other departments as they are onboarding new users.

Audit

This policy marks an Azure Active Directory as INCOMPLIANT if the related Active Directory Auth Policy has Invites From State set to either:

... see more

Remediation

Open File

Remediation

From Azure Portal

1. From Azure Home select the Portal Menu.
2. Select Microsoft Entra ID.
3. Then External Identities.
4. Select External collaboration settings.
5. Under Guest invite settings, for Guest invite restrictions, ensure that Only users assigned to specific admin roles can invite guest users is selected.

policy.yaml

Open File

Linked Framework Sections

Section	Sub Sections	Internal Rules	Policies	Flags	Compliance
💼 CIS Azure v2.1.0 → 💼 1.15 Ensure that 'Guest invite restrictions' is set to "Only users assigned to specific admin roles can invite guest users" - Level 2 (Manual)			1		no data
💼 CIS Azure v3.0.0 → 💼 2.16 Ensure that 'Guest invite restrictions' is set to 'Only users assigned to specific admin roles can invite guest users' (Automated)			1		no data
💼 CIS Azure v4.0.0 → 💼 6.16 Ensure that 'Guest invite restrictions' is set to 'Only users assigned to specific admin roles can invite guest users' (Automated)			1		no data
💼 Cloudaware Framework → 💼 User Account Management			19		no data