Check ID:
Provider: Azure
Service:
Severity: MEDIUM
Categories:
Resource type:
entra_policy_guest_users_access_restrictionsProvider: Azure
Service:
entraSeverity: MEDIUM
Categories:
identity-access, e3Resource type:
NotDefinedWhat this check verifies
Microsoft Entra authorization policy guest settings are assessed to determine whether guest user access is limited to the properties and memberships of their own directory objects (Restricted access) instead of broader visibility into users and groups
Risk
Excess guest visibility enables directory reconnaissance, exposing user and group details for phishing, password spraying, and targeted attacks. This weakens confidentiality and can facilitate privilege escalation and lateral movement through informed abuse of group memberships and access paths.Recommendation
Apply least privilege to external users:- Set guest access to
Restricted accessso guests can only view their own directory objects - Avoid assigning admin roles to guests; use PIM for rare exceptions
- Constrain external collaboration and group visibility, and run periodic access reviews to remove stale guest access
Remediation
- CLI
- Terraform
- Dashboard steps
References
- https://learn.microsoft.com/en-us/entra/identity/users/users-restrict-guest-permissions
- https://learn.microsoft.com/en-us/entra/fundamentals/users-default-permissions#member-and-guest-users
Where this check fires
This check runs on every scheduled scan against your Azure account. Findings appear at Cloud Security → Findings filterable byCheck ID = entra_policy_guest_users_access_restrictions. To re-evaluate after a fix, hit Run now on the account’s schedule under Cloud Security → Schedules — the next scan re-checks this control and marks the finding fixed or keeps it persistent.
← Back to Azure checks