Ensure That 'Guest users access restrictions' is set to 'Guest user access is restricted to properties and memberships of their own directory objects'
entra_policy_guest_users_access_restrictions
Limit guest user permissions.
Risk
Limiting guest access ensures that guest accounts do not have permission for certain directory tasks, such as enumerating users, groups or other directory resources, and cannot be assigned to administrative roles in your directory. Guest access has three levels of restriction. 1. Guest users have the same access as members (most inclusive), 2. Guest users have limited access to properties and memberships of directory objects (default value), 3. Guest user access is restricted to properties and memberships of their own directory objects (most restrictive). The recommended option is the 3rd, most restrictive: 'Guest user access is restricted to their own directory object'.
Run this check with Prowler CLI
prowler m365 --checks entra_policy_guest_users_access_restrictions
Remediation
Update-MgPolicyAuthorizationPolicy -GuestUserRoleId <GUEST_ROLE_ID>
1. Navigate to Microsoft Entra admin center https://entra.microsoft.com/. 2. Expand Identity > External Identities and select External collaboration settings. 3. Under Guest user access, set 'Guest user access restrictions' to either 'Guest users have limited access to properties and memberships of directory objects' or 'Guest user access is restricted to properties and memberships of their own directory objects (most restrictive)'.
Restrict guest user access in Microsoft Entra to limit the exposure of directory objects and reduce security risks.
Source Code
Resource Type
Authorization Policy