Check ID:
Provider: Microsoft 365
Service:
Severity: MEDIUM
Categories:
Resource type:
entra_policy_guest_users_access_restrictionsProvider: Microsoft 365
Service:
entraSeverity: MEDIUM
Categories:
identity-access, e3Resource type:
NotDefinedWhat this check verifies
Microsoft Entra authorization policy evaluates guest user access restrictions being set to the most restrictive level, where guests can view only their own directory object and related memberships (Guest user access is restricted to properties and memberships of their own directory objects).
Risk
Without this restriction, guests can read broader directory metadata and group memberships, enabling reconnaissance that harms confidentiality. A compromised guest gains context for phishing and privilege escalation, risking unauthorized changes (integrity) and disruption of collaboration spaces (availability).Recommendation
Set guest access to the most restrictive level (Guest user access is restricted...) to enforce least privilege.
- Avoid assigning admin roles to guests
- Use time-bound access with approvals
- Apply Conditional Access and limit group visibility
- Run periodic access reviews for defense in depth
Remediation
- CLI
- Terraform
- Dashboard steps
Update-MgPolicyAuthorizationPolicy -GuestUserRoleId ‘2af84b1e-32c8-42b7-82bc-daa82404023b’
References
- https://learn.microsoft.com/en-us/entra/fundamentals/users-default-permissions#member-and-guest-users
- https://www.trendmicro.com/trendaivisiononecloudriskmanagement/knowledge-base/azure/ActiveDirectory/restrict-guest-user-access.html
- https://learn.microsoft.com/en-us/entra/identity/users/users-restrict-guest-permissions
Where this check fires
This check runs on every scheduled scan against your Microsoft 365 account. Findings appear at Cloud Security → Findings filterable byCheck ID = entra_policy_guest_users_access_restrictions. To re-evaluate after a fix, hit Run now on the account’s schedule under Cloud Security → Schedules — the next scan re-checks this control and marks the finding fixed or keeps it persistent.
← Back to Microsoft 365 checks