Control: 5.15 Ensure that 'Guest users access restrictions' is set to 'Guest user access is restricted to properties and memberships of their own directory objects'
Description
Limit guest user permissions.
Limiting guest access ensures that guest accounts do not have permission for certain directory tasks, such as enumerating users, groups or other directory resources, and cannot be assigned to administrative roles in your directory. Guest access has three levels of restriction.
- Guest users have the same access as members (most inclusive),
- Guest users have limited access to properties and memberships of directory objects (default value),
- Guest user access is restricted to properties and memberships of their own directory objects (most restrictive).
The recommended option is the 3rd, most restrictive: "Guest user access is restricted to their own directory object".
Remediation
Remediate from Azure Portal
- From Azure Home select the Portal Menu.
- Select
Microsoft Entra ID. - Under
Manage, selectExternal Identities - Select
External collaboration settings. - Under
Guest user access, setGuest user access restrictionsto Guest user access is restricted to properties and memberships of their own directory objects. - Click
Save.
Remediate from PowerShell
- Enter the following to update the policy ID:
Update-MgPolicyAuthorizationPolicy -GuestUserRoleId "2af84b1e-32c8- 42b7-82bc-daa82404023b"
- Check the GuestUserRoleId again:
Get-MgPolicyAuthorizationPolicy).GuestUserRoleId
- Ensure that the GuestUserRoleId is equal to the earlier entered value of
2af84b1e-32c8-42b7-82bc-daa82404023b.
Default Value
By default, Guest user access restrictions is set to Guest users have limited access to properties and memberships of directory objects.
Usage
Run the control in your terminal:
powerpipe control run azure_compliance.control.cis_v500_5_15Snapshot and share results via Turbot Pipes:
powerpipe loginpowerpipe control run azure_compliance.control.cis_v500_5_15 --shareSQL
This control uses a named query:
with distinct_tenant as ( select distinct tenant_id, display_name, subscription_id, _ctx from azure_tenant)select id as resource, case when guest_user_role_id = '2af84b1e-32c8-42b7-82bc-daa82404023b' then 'ok' else 'alarm' end as status, case when guest_user_role_id = '2af84b1e-32c8-42b7-82bc-daa82404023b' then t.display_name || ' guest user access is restricted to properties and memberships of their own directory objects.' else t.display_name || ' guest user access is not at most restrictive; guest_user_role_id=' || coalesce(guest_user_role_id, '<null>') || '.' end as reason, t.tenant_id from distinct_tenant as t, azuread_authorization_policy;