Detections
Analytics

5.1.6.3 Ensure guest user invitations are limited

Information

By default, all users in the organization, including B2B collaboration guest users, can invite external users to B2B collaboration. The ability to send invitations can be limited by turning it on or off for everyone, or by restricting invitations to certain roles.

The recommended state is Only users assigned to specific admin roles can invite guest users or No one in the organization can invite guest users including admins (most restrictive).

Restricting who can invite guests limits the exposure the organization might face from unauthorized accounts. The default behavior allows anyone within the organization to invite guests and non-admins to the tenant, posing a security risk.

Solution

To remediate using the UI:

 - Navigate to Microsoft Entra admin center https://entra.microsoft.com/.
 - Expand Entra ID > External Identities and select External collaboration settings.
 - Under Guest invite settings set Guest invite restrictions to one of the desired compliant states:

 - Only users assigned to specific admin roles can invite guest users
 - No one in the organization can invite guest users including admins (most restrictive)

To remediate using PowerShell:

 - Connect to Microsoft Graph using Connect-MgGraph -Scopes "Policy.ReadWrite.Authorization"
 - Run one of the following PowerShell commands depending on the desired compliant state:

To set to Only users assigned to specific admin roles can invite guest users :

Update-MgPolicyAuthorizationPolicy -AllowInvitesFrom 'adminsAndGuestInviters'

To set to No one in the organization can invite guest users including admins (most restrictive) :

Update-MgPolicyAuthorizationPolicy -AllowInvitesFrom "none"

Impact:

This introduces an obstacle to collaboration by restricting who can invite guest users to the organization. Designated Guest Inviters must be assigned, and an approval process established and clearly communicated to all users.

See Also

https://workbench.cisecurity.org/benchmarks/24620

Item Details

Category: ACCESS CONTROL, AUDIT AND ACCOUNTABILITY, IDENTIFICATION AND AUTHENTICATION

References: 800-53|AC-1, 800-53|AC-2, 800-53|AC-3, 800-53|AC-6, 800-53|AC-6(1), 800-53|AC-6(7), 800-53|AU-9(4), 800-53|IA-4, 800-53|IA-5, CSCv7|13.1

Plugin: microsoft_azure

Control ID: 332a97784153eabd8c9ee0c6878f46b20495849dd69d19e7acad54af41cc3bb4