Detections
Analytics

MS.AAD.8.2v1 - Only users with the Guest Inviter role SHOULD be able to invite guest users.

Information

By only allowing an authorized group of individuals to invite external users to create accounts in the tenant, an agency can enforce a guest user account approval process, reducing the risk of unauthorized account creation.

NOTE: Nessus has provided the target output to assist in reviewing the benchmark to ensure target compliance.

Solution

1. In Microsoft Entra admin center select External Identities > External collaboration settings.

2. Under Guest invite settings, select Only users assigned to specific admin roles can invite guest users.

3. Click Save.

See Also

https://github.com/cisagov/ScubaGear/tree/v1.8.0/

Item Details

Category: ACCESS CONTROL

References: 800-53|AC-6(10)

Plugin: microsoft_azure

Control ID: 5727a878c5df80616f0dd71e83a74f8a83898511a7e75407b33e19df52952ad9