Control: 5.3.2 Ensure that guest users are reviewed on a regular basis

Description

Microsoft Entra ID has native and extended identity functionality allowing you to invite people from outside your organization to be guest users in your cloud account and sign in with their own work, school, or social identities.

While an automated assessment procedure exists for this recommendation, the assessment status remains manual. Evaluating the appropriateness of guest users requires a manual review, as it depends on the specific needs and context of each organization and environment.

Remediation

Remediate from Azure Portal

From Azure Home select the Portal Menu.
Select Microsoft Entra ID.
Under Manage, select Users.
Click on Add filter.
Select User type.
Select Guest from the Value dropdown.
Click Apply.
Check the box next to all Guest users that are no longer required or are inactive.
Click Delete.
Click OK.

Remediate from Azure CLI

Before deleting the user, set it to inactive using the ID from the Audit Procedure to determine if there are any dependent systems.

az ad user update --id <exampleaccountid@domain.com> --account-enabled {false}

After determining that there are no dependent systems, delete the user.

Remove-AzureADUser -ObjectId <exampleaccountid@domain.com>

Remediate from Azure PowerShell

Before deleting the user, set it to inactive using the ID from the Audit Procedure to determine if there are any dependent systems.

Set-AzureADUser -ObjectId "<exampleaccountid@domain.com>" -AccountEnabled false

After determining that there are no dependent systems, delete the user.

PS C:\>Remove-AzureADUser -ObjectId <exampleaccountid@domain.com>

Default Value

By default no guest users are created.

Usage

Run the control in your terminal:

powerpipe control run azure_compliance.control.cis_v500_5_3_2

Snapshot and share results via Turbot Pipes:

powerpipe login
powerpipe control run azure_compliance.control.cis_v500_5_3_2 --share

SQL

This control uses a named query:

with distinct_tenant as (
  select
    distinct tenant_id,
    subscription_id,
    _ctx
  from
    azure_tenant
)
select
  u.display_name as resource,
  case
    when not account_enabled then 'alarm'
    when u.created_date_time::timestamp <= (current_date - interval '30' day) then 'alarm'
    else 'ok'
  end as status,
  case
    when not account_enabled then 'Guest user ''' || u.display_name || ''' inactive.'
    else 'Guest user ''' || u.display_name || ''' was created ' || extract(day from current_timestamp - u.created_date_time::timestamp) || ' days ago.'
  end as reason,
  t.tenant_id
  
from
  azuread_user as u
  left join distinct_tenant as t on t.tenant_id = u.tenant_id
where
  u.user_type = 'Guest';

Control: 5.3.2 Ensure that guest users are reviewed on a regular basis

Description

Remediation

Default Value

Usage

SQL

Tags