Check ID:
Provider: Microsoft 365
Service:
Severity: LOW
Categories:
Resource type:
entra_dynamic_group_for_guests_createdProvider: Microsoft 365
Service:
entraSeverity: LOW
Categories:
identity-access, e3Resource type:
NotDefinedWhat this check verifies
Microsoft Entra groups are evaluated for dynamic membership that includes only users withuserType -eq "Guest".
The finding indicates whether a guest-targeted dynamic group exists to centrally scope policies and governance.
Risk
Without a dedicated dynamic guest group, guests may evade consistent Conditional Access and least-privilege controls. This threatens confidentiality via excess data access, weakens integrity through unauthorized changes, and leaves stale external accounts that enable lateral movement.Recommendation
Establish a dynamic group limited to users withuserType -eq "Guest" and use it to scope Conditional Access, least-privilege roles, and access reviews.
Segment guests by risk into separate groups, enforce lifecycle policies, and regularly audit membership and policy coverage.
Remediation
- CLI
- Terraform
- Dashboard steps
New-MgGroup -DisplayName ‘Dynamic Guest Users’ -MailNickname ‘DynGuestUsers’ -MailEnabled true -GroupTypes ‘DynamicMembership’ -MembershipRule ‘(user.userType -eq “Guest”)’ -MembershipRuleProcessingState ‘On’
References
Where this check fires
This check runs on every scheduled scan against your Microsoft 365 account. Findings appear at Cloud Security → Findings filterable byCheck ID = entra_dynamic_group_for_guests_created. To re-evaluate after a fix, hit Run now on the account’s schedule under Cloud Security → Schedules — the next scan re-checks this control and marks the finding fixed or keeps it persistent.
← Back to Microsoft 365 checks