Description:

Azure AD is extended to include Azure AD B2B collaboration, allowing you to invite people from outside your organization to be guest users in your cloud account and sign in with their own work, school, or social identities. Guest users allow you to share your company's applications and services with users from any other organization while maintaining control over your own corporate data.


Rationale:

Guest users in the Azure AD are generally required for collaboration purposes in Office 365, and may also be required for Azure functions in enterprises with multiple Azure tenants, Guest users should be reviewed on a regular basis, at least annually, Guest users should not be granted administrative roles where possible.


Impact:

Until you have a business needs to provide guest access to any user, avoid creating guest users. If guest accounts are being used, they should be removed when no longer required.


Audit:

  1. Go to Azure Active Directory

  2. Go to Users and group

  3. Go to All Users

  4. Click on Add filters, select User type, then click on Apply


  5. Click on User type, select Guest users, then click on Apply


  6. Ensure that guest users listed are still required (USER TYPE = Guest)


Using Azure Command-Line Interface 2.0

az ad user list --query "[?userType=='Guest']"

Ensure all users listed are not inactive and still required.


Using PowerShell

Connect-AzureAD  (Only needs to be performed once within the PowerShell session)
Get-AzureADUser |Where-Object {$_.UserType -like "Guest"} |Select-Object DisplayName, UserPrincipalName, UserType -Unique


Remediation:

Pre-Requisite:

  1. A working Azure AD tenant with at least an Azure AD Premium P1 or trial license enabled.

  2. An account with global administrator privileges.


Implementation:

  1. Go to Azure Active Directory

  2. Go to Users and group

  3. Go to All Users

  4. Click on Add filters, select User type, then click on Apply


  5. Click on User type, select Guest users, then click on Apply


  6. Select the Guest user which is no longer required and then click on Delete User


Backout Plan:

After deleting Guest users we can’t restore them back but we can add a New Guest user to an organization and also Invite a new guest user to collaborate with the organization.


References:

  1. Properties of a B2B guest user - Azure Active Directory 

  2. https://docs.microsoft.com/en-us/azure/active-directory/fundamentals/add- users-azure-active-directory#delete-a-user

  3. https://docs.microsoft.com/en-us/azure/security/benchmarks/security-controls- v2-privileged-access#pa-3-review-and-reconcile-user-access-regularly