🛡️ Microsoft Entra ID Guest Users restricted to their own directory objects🟢

• Contextual name: 🛡️ Guest Users restricted to their own directory objects🟢
• ID: /ce/ca/azure/microsoft-entra-id/guest-users-restricted-to-their-own-directory
• Tags:
  • 🟢 Policy with categories
  • 🟢 Policy with type
  • 🟢 Production policy
• Policy Type: COMPLIANCE_POLICY
• Policy Categories: SECURITY

Stats

not available

Logic

• 🧠 prod.logic.yaml🟢
  • 📗 Azure Active Directory
  • 🔌 Azure Active Directory Auth Policy - object.extracts.yaml
  • 🧪 test-data.json

Similar Policies

• Cloud Conformity: Guest User Permissions Are Limited

Description

Open File

Description

Limit guest user permissions.

Rationale

Limiting guest access ensures that guest accounts do not have permission for certain directory tasks, such as enumerating users, groups, or other directory resources, and cannot be assigned to administrative roles in your directory. Guest access has three levels of restriction:

1. Guest users have the same access as members (most inclusive).
2. Guest users have limited access to properties and memberships of directory objects (default value).
3. Guest user access is restricted to properties and memberships of their own directory objects (most restrictive).

The recommended option is the 3rd, most restrictive: "Guest user access is restricted to their own directory object".

Impact

This may create additional requests for permissions to access resources that administrators will need to approve.

According to https://learn.microsoft.com/en-us/azure/active-directory/enterprise-users/users-restrict-guest-permissions#services-currently-not-supported,

Services without current support might have compatibility issues with the new guest restriction setting.

... see more

Remediation

Open File

Remediation

From Azure Portal

1. In the Azure portal, open the portal menu.
2. Select Microsoft Entra ID.
3. Under Manage, select External Identities.
4. Select External collaboration settings.
5. Under Guest user access, set Guest user access restrictions to Guest user access is restricted to properties and memberships of their own directory objects.
6. Click Save.

From PowerShell

1. Enter the following to update the policy ID:

   Update-MgPolicyAuthorizationPolicy -GuestUserRoleId "2af84b1e-32c8-42b7-82bc-daa82404023b"

2. Check the GuestUserRoleId again:

   (Get-MgPolicyAuthorizationPolicy).GuestUserRoleId

3. Ensure that the GuestUserRoleId is equal to the earlier entered value of 2af84b1e-32c8-42b7-82bc-daa82404023b.

policy.yaml

Open File

Linked Framework Sections

Section	Sub Sections	Internal Rules	Policies	Flags	Compliance
💼 CIS Azure v5.0.0 → 💼 5.15 Ensure that 'Guest users access restrictions' is set to 'Guest user access is restricted to properties and memberships of their own directory objects' (Automated)			1		no data
💼 Cloudaware Framework → 💼 User Account Management			9		no data