Microsoft Entra IDOverview
Restrict invitations to users with specific administrative roles only.
Rationale
Restricting invitations to users with specific administrator roles ensures that only authorized accounts can access cloud resources. This helps to maintain "Need to Know" permissions and prevents inadvertent access to data.
By default, Guest invite restrictions is set to Anyone in the organization can invite guest users including guests and non-admins. This would allow anyone within the organization to invite guests and non-admins to the tenant, posing a security risk.
Impact
With the option of Only users assigned to specific admin roles can invite guest users selected, users with specific admin roles will be responsible for sending invitations to the external users, requiring additional overhead to manage user accounts. This will mean coordinating with other departments as they are onboarding new users.
Default Value
By default, Guest invite restrictions is set to Anyone in the organization can invite guest users including guests and non-admins.
Remediation guidance
From Azure Portal
- Open External Identities | External collaboration settings
- Under
Guest invite settings, forGuest invite restrictions, ensure thatOnly users assigned to specific admin roles can invite guest usersis selected.
PowerShell
Connect-MgGraph
Update-MgPolicyAuthorizationPolicy -AllowInvitesFrom "adminsAndGuestInviters"
Service-wide remediation
Recommended when many resources are affected: fix the platform baseline first so new resources inherit the secure setting, then remediate the existing flagged resources in batches.
Microsoft Entra ID
Use tenant-wide Conditional Access, role settings, authentication policies, and identity governance baselines so the control is enforced centrally.
Operational rollout
- Fix the baseline first at the account, subscription, project, cluster, or tenant scope that owns this control.
- Remediate the currently affected resources in batches, starting with internet-exposed and production assets.
- Re-scan and track approved exceptions with an owner and expiry date.
Query logic
These are the stored checks tied to this control.
Entra with permissive guest invite restrictions
Connectors
Covered asset types
Expected check: eq []
{
connectors(
where: {
authorizationPolicy: {
NOT: { allowInvitesFrom: "adminsAndGuestInviters" }
}
}
) {
...AssetFragment
}
}
