1.1.13 Ensure that collaboration invitations are sent to allowed domains only

Warning! Audit Deprecated

This audit has been deprecated and will be removed in a future update.

View Next Audit Version


Users should be able to send collaboration invitations to allowed domains only.


By specifying allowed domains for collaborations, external users companies are explicitly identified. Also, this prevents internal users from inviting unknown external users such as personal accounts and give them access to resources.


This could make harder collaboration if the setting is not quickly updated when a new domain is identified as 'allowed'.

NOTE: Nessus has not performed this check. Please review the benchmark to ensure target compliance.


From the Azure portal:

Go to Azure Active Directory

Go to Users

Go to User settings

Under External users, click on Manage external collaboration settings

Under Collaboration restrictions, select Allow invitations only to the specified domains (most restrictive), check the Target domains setting, and specify the domains allowed to collaborate.

Default Value:

Default value is Allow invitations to be sent to any domain (most inclusive) and thus no domain is specified.

See Also