Microsoft Entra IDOverview
Limit guest user permissions.
Rationale
Limiting guest access ensures that guest accounts do not have permission for certain directory tasks, such as enumerating users, groups, or other directory resources, and cannot be assigned to administrative roles in your directory. Guest access has three levels of restriction.
- Guest users have the same access as members (most inclusive),
- Guest users have limited access to properties and memberships of directory objects (default value),
- Guest user access is restricted to properties and memberships of their own directory objects (most restrictive).
The recommended option is the 3rd, most restrictive: "Guest user access is restricted to their own directory object".
Impact
This may create additional requests for permissions to access resources that administrators will need to approve.
Certain services might have compatibility issues with this setting.
Default Value
By default, Guest user access restrictions is set to Guest users have limited access to properties and memberships of directory objects.
Remediation guidance
From Azure Portal
- Open External Identities | External collaboration settings
- Under
Guest user access, changeGuest user access restrictionstoGuest user access is restricted to properties and memberships of their own directory objects.
From PowerShell
- From a PowerShell session, enter
Set-AzureADMSAuthorizationPolicy -GuestUserRoleId '2af84b1e-32c8-42b7-82bc-daa82404023b' - Check that the setting was applied by entering
Get-AzureADMSAuthorizationPolicy - Make sure the GuestUserRoleId is equal to
2af84b1e-32c8-42b7-82bc-daa82404023b.
Service-wide remediation
Recommended when many resources are affected: fix the platform baseline first so new resources inherit the secure setting, then remediate the existing flagged resources in batches.
Microsoft Entra ID
Use tenant-wide Conditional Access, role settings, authentication policies, and identity governance baselines so the control is enforced centrally.
Operational rollout
- Fix the baseline first at the account, subscription, project, cluster, or tenant scope that owns this control.
- Remediate the currently affected resources in batches, starting with internet-exposed and production assets.
- Re-scan and track approved exceptions with an owner and expiry date.
Query logic
These are the stored checks tied to this control.
Entra with permissive guest user restrictions
Connectors
Covered asset types
Expected check: eq []
{
connectors(
where: {
authorizationPolicy: {
NOT: { guestUserRoleId: "2af84b1e-32c8-42b7-82bc-daa82404023b" }
}
}
) {
...AssetFragment
}
}
