# Ensure Guest Users Are Reviewed on a Regular Basis

- Source: https://support.icompaas.com/support/solutions/articles/62000219681-ensure-guest-users-are-reviewed-on-a-regular-basis
- Section: [Solutions](https://support.icompaas.com/support/solutions) › [Azure CIS Benchmark Level 1 & Level 2](https://support.icompaas.com/support/solutions/62000112163) › [1. Identity and Access Management](https://support.icompaas.com/support/solutions/folders/62000167544)
- Last updated: 2026-06-09
- Publisher: iCompaas, Inc. (https://www.icompaas.com)

## **Description:**

Azure AD is extended to include Azure AD B2B collaboration, allowing you to invite people from outside your organization to be guest users in your cloud account and sign in with their own work, school, or social identities. Guest users allow you to share your company's applications and services with users from any other organization while maintaining control over your own corporate data.

  

## **Rationale:**

Guest users in the Azure AD are generally required for collaboration purposes in Office 365, and may also be required for Azure functions in enterprises with multiple Azure tenants, Guest users should be reviewed on a regular basis, at least annually, Guest users should not be granted administrative roles where possible.

  

## **Impact:**

Until you have a business needs to provide guest access to any user, avoid creating guest users. If guest accounts are being used, they should be removed when no longer required.

  

## **Audit:**

1.  Go to Azure Active Directory
    
2.  Go to Users and group
    
3.  Go to All Users
    
4.  Click on **Add filters**, select **User type,** then click on **Apply**
    
      
    
5.  Click on **User type**, select **Guest users,** then click on **Apply**
    
      
    
6.  Ensure that guest users listed are still required (USER TYPE = Guest)

  

## **Using Azure Command-Line Interface 2.0**

az ad user list --query "\[?userType=='Guest'\]"

**Ensure all users listed are not inactive and still required.**

## Using PowerShell

Connect-AzureAD  (Only needs to be performed once within the PowerShell session)
Get-AzureADUser |Where-Object {$\_.UserType -like "Guest"} |Select-Object DisplayName, UserPrincipalName, UserType -Unique

## ****Remediation:****

### Pre-Requisite:

1.  A working Azure AD tenant with at least an Azure AD Premium P1 or trial license enabled.
    
2.  An account with _global administrator_ privileges.
    

  

### Implementation:

1.  Go to Azure Active Directory  
    ![](https://support.icompaas.com/assets/kb/349b1086dc6c4f05.png)
    
2.  Go to Users and group  
    ![](https://support.icompaas.com/assets/kb/7a1a09a1452d5681.png)
    
3.  Go to All Users  
    ![](https://support.icompaas.com/assets/kb/3e76449f404d9a5f.png)
    
4.  Click on **Add filters**, select **User type,** then click on **Apply**  
    **![](https://support.icompaas.com/assets/kb/061ebac2ca3b4ccc.png)**
    
      
    
5.  Click on **User type**, select **Guest users,** then click on **Apply**  
    **![](https://support.icompaas.com/assets/kb/58fcf471e9364ed8.png)**
    
      
    
6.  **Select the Guest user which is no longer required and then click on** ****Delete User****  
    ****![](https://support.icompaas.com/assets/kb/a07d7137bb30d8fe.png)****  
    

  

### Backout Plan:

After deleting Guest users we can’t restore them back but we can add a New Guest user to an organization and also Invite a new guest user to collaborate with the organization.  
![](https://support.icompaas.com/assets/kb/edee225d2b1d252a.png)

## ****References:****

-   [Properties of a B2B guest user - Azure Active Directory](https://docs.microsoft.com/en-us/azure/active-directory/b2b/user-properties) 
    
-   [https://docs.microsoft.com/en-us/azure/active-directory/fundamentals/add- users-azure-active-directory#delete-a-user](https://docs.microsoft.com/en-us/azure/active-directory/fundamentals/add-users-azure-active-directory#delete-a-user "https://docs.microsoft.com/en-us/azure/active-directory/fundamentals/add-users-azure-active-directory#delete-a-user")
    
-   [https://docs.microsoft.com/en-us/azure/security/benchmarks/security-controls- v2-privileged-access#pa-3-review-and-reconcile-user-access-regularly](https://docs.microsoft.com/en-us/azure/security/benchmarks/security-controls-v2-privileged-access#pa-3-review-and-reconcile-user-access-regularly "https://docs.microsoft.com/en-us/azure/security/benchmarks/security-controls-v2-privileged-access#pa-3-review-and-reconcile-user-access-regularly")

## Related compliance guidance

- [SOC 2 compliance: a practical implementation guide for cloud-native SaaS teams](https://support.icompaas.com/compliance/soc-2-trust-services-criteria): Configuration checks like this one are the technical half of a SOC 2 / ISO 27001 programme — the guide shows where they fit, what else an auditor expects, and how to evidence them.
- [ISO/IEC 27001:2022 compliance: a practical implementation guide](https://support.icompaas.com/compliance/iso-27001-2022): ISO 27001 Annex A.8 (technological controls) is where cloud hardening evidence lands; the guide shows how to run the ISMS around it.