Detections
Analytics

5.1.3.1 (L1) Ensure a dynamic group for guest users is created

Warning! Audit Deprecated

This audit has been deprecated and will be removed in a future update.

View Next Audit Version

Information

A dynamic group is a dynamic configuration of security group membership for Microsoft Entra ID. Administrators can set rules to populate groups that are created in Entra ID based on user attributes (such as userType, department, or country/region). Members can be automatically added to or removed from a security group based on their attributes.

The recommended state is to create a dynamic group that includes guest accounts.

Dynamic groups allow for an automated method to assign group membership.

Guest user accounts will be automatically added to this group and through this existing conditional access rules, access controls and other security measures will ensure that new guest accounts are restricted in the same manner as existing guest accounts.

Solution

To remediate using the UI:

 - Navigate to Microsoft Entra admin center https://entra.microsoft.com/.
 - Click to expand Entra ID > Groups select All groups.
 - Select New group and assign the following values:
 - Group type: Security
 - Microsoft Entra roles can be assigned to the group: No
 - Membership type: Dynamic User

 - Select Add dynamic query.
 - Above the Rule syntax text box, select Edit.
 - Place the following expression in the box:
(user.userType -eq "Guest")
 - Select OK and Save

 To remediate using PowerShell:

 - Connect to Microsoft Graph using Connect-MgGraph -Scopes "Group.ReadWrite.All"
 - In the script below edit DisplayName and MailNickname as needed and run:
$params = @{
 DisplayName = "Dynamic Guest Group"
 MailNickname = "DynGuestUsers"
 MailEnabled = $false
 SecurityEnabled = $true
 GroupTypes = "DynamicMembership"
 MembershipRule = '(user.userType -eq "Guest")'
 MembershipRuleProcessingState = "On"
 }

 New-MgGroup @params

See Also

https://workbench.cisecurity.org/benchmarks/24619

Item Details

Category: ACCESS CONTROL, MEDIA PROTECTION

References: 800-53|AC-3, 800-53|AC-5, 800-53|AC-6, 800-53|MP-2

Plugin: microsoft_azure

Control ID: 7df2a863b5660d39abf5525669848dcfd6fa99067bec1a41faef271c477bff7d