Ensure Guest Users Are Reviewed on a Regular Basis (Manual)

Microsoft Entra ID is extended to include Azure AD B2B collaboration, allowing you to invite people outside your organization to be guest users in your cloud account and sign in with their work, school, or social identities. Guest users allow you to share your company's applications and services with users from any other organization while maintaining control over your corporate data.

Work with external partners, large or small, even if they don't have Azure AD or an IT department. A simple invitation and redemption process lets partners use their credentials to access your company's resources as guest users.

Guest users in every subscription should be reviewed regularly to ensure that inactive and unneeded accounts are removed.

Rationale

Guest users in the Microsoft Entra ID are generally required for collaboration purposes in Office 365 and may also be required for Azure functions in enterprises with multiple Azure tenants. Guest users are typically added outside your employee onboarding/offboarding process and could be overlooked indefinitely, leading to a potential vulnerability. To prevent this, guest users should be reviewed regularly. During this audit, guest users should also be determined not to have administrative privileges.

Impact

Before removing guest users, determine their use and scope. Like removing any user, there may be unforeseen consequences to systems if it is deleted.

Default Value

By default, there are no guest users.

Additional Information

It is good practice to use a dynamic security group to manage guest users.

To create the dynamic security group:

1. Navigate to the Microsoft Entra ID blade in the Azure Portal
2. Select the Groups item
3. Create new
4. Type of dynamic
5. Use the following dynamic selection rule. (user.userType -eq "Guest")
6. Once the group has been created, select access reviews option and create a new access review with a monthly period, and send it to relevant administrators for review.