Skip to main content

📝 Microsoft Entra ID Guest Users restricted to their own directory objects 🟢

  • Contextual name: 📝 Guest Users restricted to their own directory objects 🟢
  • ID: /ce/ca/azure/microsoft-entra-id/guest-users-restricted-to-their-own-directory
  • Located in: 📁 Microsoft Entra ID

Flags​

Our Metadata​

  • Policy Type: COMPLIANCE_POLICY
  • Policy Category:
    • SECURITY

Similar Policies​

Logic​

Description​

Open File

Description​

Limit guest user permissions.

Rationale​

Limiting guest access ensures that guest accounts do not have permission for certain directory tasks, such as enumerating users, groups or other directory resources, and cannot be assigned to administrative roles in your directory. Guest access has three levels of restriction.

  1. Guest users have the same access as members (most inclusive).
  2. Guest users have limited access to properties and memberships of directory objects (default value).
  3. Guest user access is restricted to properties and memberships of their own directory objects (most restrictive).

The recommended option is the 3rd, most restrictive: "Guest user access is restricted to their own directory object".

Impact​

This may create additional requests for permissions to access resources that administrators will need to approve.

According to https://learn.microsoft.com/en-us/azure/active-directory/enterprise-users/users-restrict-guest-permissions#services-currently-not-supported

Service without current support might have compatibility issues with the new guest restriction setting.

... see more

Remediation​

Open File

Remediation​

From Azure Portal​

  1. From Azure Home select the Portal Menu.
  2. Select Microsoft Entra ID.
  3. Then External Identities.
  4. Select External collaboration settings.
  5. Under Guest user access, change Guest user access restrictions to be Guest user access is restricted to properties and memberships of their own directory objects.

From PowerShell​

  1. From a PowerShell session enter:
Set-AzureADMSAuthorizationPolicy -GuestUserRoleId '2af84b1e-32c8-42b7-82bc-daa82404023b'
  1. Check that the setting was applied by entering:
Get-AzureADMSAuthorizationPolicy
  1. Make certain that the GuestUserRoleId is equal to the earlier entered value of 2af84b1e-32c8-42b7-82bc-daa82404023b.

policy.yaml​

Open File

Linked Framework Sections​

SectionSub SectionsInternal RulesPoliciesFlags
💼 CIS Azure v2.1.0 → 💼 1.14 Ensure That 'Guest users access restrictions' is set to 'Guest user access is restricted to properties and memberships of their own directory objects' - Level 1 (Manual)1
💼 CIS Azure v3.0.0 → 💼 2.15 Ensure That 'Guest users access restrictions' is set to 'Guest user access is restricted to properties and memberships of their own directory objects' (Automated)1
💼 Cloudaware Framework → 💼 User Account Management14