Skip to main content

📝 Microsoft Entra ID Guest Users are not reviewed on a regular basis 🟢

  • Contextual name: 📝 Guest Users are not reviewed on a regular basis 🟢
  • ID: /ce/ca/azure/microsoft-entra-id/guest-users-regular-review
  • Located in: 📁 Microsoft Entra ID

Flags​

Our Metadata​

  • Policy Type: COMPLIANCE_POLICY
  • Policy Category:
    • SECURITY

Similar Policies​

Description​

Open File

Description​

Microsoft Entra ID has native and extended identity functionality allowing you to invite people from outside your organization to be guest users in your cloud account and sign in with their own work, school, or social identities.

Rationale​

Guest users are typically added outside your employee on-boarding/off-boarding process and could potentially be overlooked indefinitely. To prevent this, guest users should be reviewed on a regular basis. During this audit, guest users should also be determined to not have administrative privileges.

Impact​

Before removing guest users, determine their use and scope. Like removing any user, there may be unforeseen consequences to systems if an account is removed without careful consideration.

Audit​

From Azure Portal​
  1. From Azure Home select the Portal Menu.
  2. Select Microsoft Entra ID.
  3. Under Manage, select Users.
  4. Click on Add filter.
  5. Select User type.
  6. Select Guest from the Value dropdown.
  7. Click Apply.
  8. Audit the listed guest users.

... see more

Remediation​

Open File

Remediating​

From Azure Portal​

  1. From Azure Home select the Portal Menu.
  2. Select Microsoft Entra ID.
  3. Under Manage, select Users.
  4. Click on Add filter.
  5. Select User type.
  6. Select Guest from the Value dropdown.
  7. Click Apply.
  8. Check the box next to all Guest users that are no longer required or are inactive.
  9. Click Delete.
  10. Click OK.

From Azure CLI​

Before deleting the user, set it to inactive using the ID from the Audit Procedure to determine if there are any dependent systems:

az ad user update --id <exampleaccountid@domain.com> --account-enabled {false}

After determining that there are no dependent systems delete the user:

Remove-AzureADUser -ObjectId <exampleaccountid@domain.com>

From Azure PowerShell​

Before deleting the user, set it to inactive using the ID from the Audit Procedure to determine if there are any dependent systems:

Set-AzureADUser -ObjectId "<exampleaccountid@domain.com>" -AccountEnabled false

After determining that there are no dependent systems delete the user:

... see more

policy.yaml​

Open File

Linked Framework Sections​

SectionSub SectionsInternal RulesPoliciesFlags
💼 CIS Azure v2.1.0 → 💼 1.4 Ensure Guest Users Are Reviewed on a Regular Basis - Level 1 (Manual)1
💼 CIS Azure v3.0.0 → 💼 2.4 Ensure Guest Users Are Reviewed on a Regular Basis (Manual)1
💼 Cloudaware Framework → 💼 User Account Management14