rules/findings/entra/guest/eid-guest-invite-restriction-disabled.json
|
{
"provider": "EntraID", "serviceType": "External Collaboration", "serviceName": "Microsoft Entra ID", "displayName": "Ensure that \u0027Guest invite restrictions\u0027 is set to \u0027Only users assigned to specific admin roles can invite guest users\u0027", "description": "Restrict invitations to users with specific administrative roles only.", "rationale": "Restricting invitations to users with specific administrator roles ensures that only authorized accounts have access to cloud resources. This helps to maintain \u0022Need to Know\u0022 permissions and prevents inadvertent access to data.\r\n\t\t\t\t\r\n\t\t\t\tBy default the setting \u0060Guest invite restrictions\u0060 is set to \u0060Anyone in the organization can invite guest users including guests and non-admins\u0060. This would allow anyone within the organization to invite guests and non-admins to the tenant, posing a security risk.", "impact": "With the option of \u0060Only users assigned to specific admin roles can invite guest users\u0060 selected, users with specific admin roles will be in charge of sending invitations to the Azure Workspace, requiring additional overhead by them to manage user accounts. This will mean coordinating with other departments as they are onboarding new users, and manually removing access from users who no longer need it.", "remediation": { "text": "###### From Azure Console\r\n\t\t\t\t\t\t1. Go to \u0060Microsoft Entra ID\u0060\r\n\t\t\t\t\t\t2. Go to \u0060External Identities\u0060\r\n\t\t\t\t\t\t3. Go to \u0060External collaboration settings\u0060\r\n\t\t\t\t\t\t4. Under \u0060Guest invite settings\u0060, for \u0060Guest invite restrictions\u0060, ensure that that \u0060Only users assigned to specific admin roles can invite guest users\u0060 is selected", "code": { "powerShell": null, "iac": null, "terraform": null, "other": null } }, "recommendation": null, "references": [ "https://learn.microsoft.com/en-us/azure/active-directory/external-identities/external-collaboration-settings-configure", "https://learn.microsoft.com/en-us/security/benchmark/azure/security-controls-v3-governance-strategy#gs-6-define-identity-and-privileged-access-strategy", "https://learn.microsoft.com/en-us/security/benchmark/azure/security-controls-v3-governance-strategy#gs-2-define-enterprise-segmentation-strategy", "https://learn.microsoft.com/en-us/security/benchmark/azure/security-controls-v3-privileged-access#pa-5-automate-entitlement-management" ], "compliance": [ { "name": "CIS Microsoft 365 Foundations Benchmark", "version": "6.1.0", "reference": "5.1.6.3", "profile": [ "E3 Level 2", "E5 Level 2" ] } ], "level": "medium", "tags": [], "rule": { "path": "aad_authorization_policy", "subPath": null, "selectCondition": {}, "query": [ { "filter": [ { "conditions": [ [ "tenantAuthPolicy.allowInvitesFrom", "ne", "adminsAndGuestInviters" ] ] } ] } ], "shouldExist": null, "returnObject": null, "removeIfNotExists": null }, "output": { "html": { "data": { "properties": { "tenantAuthPolicy.displayName": "Display Name", "tenantAuthPolicy.description": "Description", "tenantAuthPolicy.allowInvitesFrom": "Allow Invites From" }, "expandObject": null }, "table": "default", "decorate": [], "emphasis": [], "actions": { "objectData": { "properties": [ "tenantAuthPolicy" ], "expandObject": null, "limit": null }, "showGoToButton": "False", "showModalButton": "True", "directLink": null } }, "text": { "data": { "properties": { "tenantAuthPolicy": "tenantAuthPolicy" }, "expandObject": null }, "status": { "keyName": [], "message": "Guest invite restrictions is not correctly set", "defaultMessage": null }, "properties": { "resourceName": "tenantAuthPolicy.displayName", "resourceId": "tenantAuthPolicy.id", "resourceType": "EntraAuthorizationPolicy" }, "onlyStatus": false } }, "idSuffix": "eid_guest_invite_all_enabled", "notes": [], "categories": [], "immutableProperties": [ "tenantAuthPolicy.id" ], "id": "entraid_1135" } |