1.15 Ensure That 'Guest users access restrictions' is set to 'Guest user access is restricted to properties and memberships of their own directory objects'

Information

Limit guest user permissions.

Rationale:

Limiting guest access ensures that guest accounts do not have permission for certain directory tasks, such as enumerating users, groups or other directory resources, and cannot be assigned to administrative roles in your directory. Guest access has three levels of restriction.

Guest users have the same access as members (most inclusive),

Guest users have limited access to properties and memberships of directory objects (default value),

Guest user access is restricted to properties and memberships of their own directory objects (most restrictive).

The recommended option is the 3rd, most restrictive: 'Guest user access is restricted to their own directory object'.

Impact:

This may create additional requests for permissions to access resources that administrators will need to approve.

NOTE: Nessus has not performed this check. Please review the benchmark to ensure target compliance.

Solution

From Azure Portal

From Azure Home select the Portal Menu

Select Azure Active Directory

Then External Identities

Select External collaboration settings

Under Guest user access, change Guest user access restrictions to be Guest user access is restricted to properties and memberships of their own directory objects

From PowerShell

From a PowerShell session enter Set-AzureADMSAuthorizationPolicy -GuestUserRoleId '2af84b1e-32c8-42b7-82bc-daa82404023b'

Check that the setting was applied by entering Get-AzureADMSAuthorizationPolicy

Make certain that the GuestUserRoleId is equal to the earlier entered value of 2af84b1e-32c8-42b7-82bc-daa82404023b.

Default Value:

By default, Guest user access restrictions is set to Guest user access is restricted to properties and memberships of their own directory objects.

See Also

https://workbench.cisecurity.org/benchmarks/10624

Item Details

Category: ACCESS CONTROL, AUDIT AND ACCOUNTABILITY, MEDIA PROTECTION, RISK ASSESSMENT

References: 800-53|AC-2, 800-53|AC-2(1), 800-53|AC-3, 800-53|AC-5, 800-53|AC-6, 800-53|AC-6(1), 800-53|AC-6(7), 800-53|AU-9(4), 800-53|MP-2, 800-53|RA-2, CSCv7|14.6

Plugin: microsoft_azure

Control ID: 83988b001aa4de3d64470417a95629d3455d87945e3ed8068e87ecddd3c17015