Check ID: entra_policy_guest_invite_only_for_admin_roles
Provider: Microsoft 365
Service: entra
Severity: HIGH
Categories: identity-access, e3
Resource type: NotDefined

​
What this check verifies

Microsoft Entra authorization policy controls guest invitations via guest_invite_settings. It should be adminsAndGuestInviters or none, so only specific administrative roles can invite guests-or invitations are disabled.

​
Risk

Unrestricted invites allow broad creation of external identities. A compromised user can onboard attacker-controlled guests, gaining ongoing access to teams, sites, and apps. This erodes confidentiality, enables privilege abuse, and complicates revocation and audit.

​
Recommendation

Apply least privilege: restrict invites to the Guest Inviter or designated admin roles (adminsAndGuestInviters), or disable invites (none).
  • Require approval and justification
  • Allowlist partner domains and use access reviews
  • Combine with Conditional Access and cross-tenant policies for defense in depth

​
Remediation

Update-MgPolicyAuthorizationPolicy -AuthorizationPolicyId authorizationPolicy -AllowInvitesFrom adminsAndGuestInviters

​
References

​
Where this check fires

This check runs on every scheduled scan against your Microsoft 365 account. Findings appear at Cloud Security → Findings filterable by Check ID = entra_policy_guest_invite_only_for_admin_roles. To re-evaluate after a fix, hit Run now on the account’s schedule under Cloud Security → Schedules — the next scan re-checks this control and marks the finding fixed or keeps it persistent.
← Back to Microsoft 365 checks