Check ID: entra_policy_guest_invite_only_for_admin_roles
Provider: Azure
Service: entra
Severity: HIGH
Categories: identity-access, e3
Resource type: NotDefined

​
What this check verifies

Microsoft Entra authorization policy controls who can send B2B guest invitations. Secure posture is when invitations are restricted to specific admin roles (adminsAndGuestInviters) or completely disabled (none).

​
Risk

Open guest invitation rights let members or guests add external users without oversight, expanding the attack surface. Impacts:
  • Confidentiality: data leakage via overshared resources
  • Integrity: privilege escalation through group/team access
  • Availability: difficult containment due to account sprawl

​
Recommendation

Restrict invitations to Only users assigned to specific admin roles can invite guest users, or disable them where not needed. Apply least privilege (use dedicated Guest Inviter role), enforce approvals, allowlist trusted domains, and run periodic access reviews with audit monitoring to remove stale or risky guests.

​
Remediation

az rest --method PATCH --url https://graph.microsoft.com/v1.0/policies/authorizationPolicy/authorizationPolicy --headers 'Content-Type=application/json' --body '{"allowInvitesFrom":"adminsAndGuestInviters"}'

​
References

​
Where this check fires

This check runs on every scheduled scan against your Azure account. Findings appear at Cloud Security → Findings filterable by Check ID = entra_policy_guest_invite_only_for_admin_roles. To re-evaluate after a fix, hit Run now on the account’s schedule under Cloud Security → Schedules — the next scan re-checks this control and marks the finding fixed or keeps it persistent.
← Back to Azure checks