Microsoft Entra IDOverview
Restrict invitations to users with specific administrative roles only.
Rationale
Restricting invitations to users with specific administrator roles ensures that only authorized accounts can access cloud resources. This helps to maintain "Need to Know" permissions and prevents inadvertent access to data.
By default, Guest invite restrictions is set to Anyone in the organization can invite guest users including guests and non-admins. This would allow anyone within the organization to invite guests and non-admins to the tenant, posing a security risk.
Impact
With the option of Only users assigned to specific admin roles can invite guest users selected, users with specific admin roles will be responsible for sending invitations to the external users, requiring additional overhead to manage user accounts. This will mean coordinating with other departments as they are onboarding new users.
Default Value
By default, Guest invite restrictions is set to Anyone in the organization can invite guest users including guests and non-admins.
Remediation guidance
From Azure Portal
- Open External Identities | External collaboration settings
- Under
Guest invite settings, forGuest invite restrictions, ensure thatOnly users assigned to specific admin roles can invite guest usersis selected.
PowerShell
Connect-MgGraph
Update-MgPolicyAuthorizationPolicy -AllowInvitesFrom "adminsAndGuestInviters"
Multiple Remediation Paths
SERVICE-WIDE (RECOMMENDED when many resources are affected): Apply organization/tenant-level guardrails and baseline policies for the entire platform.
ASSET-LEVEL: Fix only the affected resources identified by this control.
PREVENTIVE: Add preventive policy checks to CI/CD and periodic posture scans.
References for Service-Wide Patterns
- Platform policy/governance and preventive control patterns should be applied tenant-wide where supported.
Query logic
These are the stored checks tied to this control.
Entra with permissive guest invite restrictions
Connectors
Covered asset types
Expected check: eq []
{
connectors(
where: {
authorizationPolicy: {
NOT: { allowInvitesFrom: "adminsAndGuestInviters" }
}
}
) {
...AssetFragment
}
}
