# 1.12 Ensure that 'Guest user permissions are limited' is set to 'Yes'

- Source: https://support.icompaas.com/support/solutions/articles/62000219690-1-12-ensure-that-guest-user-permissions-are-limited-is-set-to-yes-
- Section: [Solutions](https://support.icompaas.com/support/solutions) › [Azure CIS Benchmark Level 1 & Level 2](https://support.icompaas.com/support/solutions/62000112163) › [1. Identity and Access Management](https://support.icompaas.com/support/solutions/folders/62000167544)
- Last updated: 2026-05-29
- Publisher: iCompaas, Inc. (https://www.icompaas.com)

## **Description:**

Limit guest user permissions.

  

## **Rationale:**

Limiting guest access ensures that guest accounts do not have permission for certain directory tasks, such as enumerating users, groups or other directory resources, and cannot be assigned to administrative roles in your directory. If guest access in not limited, they have the same access to directory data as regular users.

  

## **Default Value:**

By default, **Guest users permissions are limited** is set to Yes.

  

## **Audit:**

1.  Go to Azure Active Directory
    
2.  Go to External Identities
    
3.  Go to External collaboration settings
    
4.  Ensure that Guest users permissions are limited is set to Yes
    

## **Remediation:**

### Pre-Requisite:

1.  A working Azure AD tenant with at least an Azure AD Premium P1 or trial license enabled.
    
2.  An account with _global administrator_ privileges.
    

### Implementation Steps:

1.  Go to Azure Active Directory
    
2.  Go to External Identities  
    ![](https://support.icompaas.com/assets/kb/975b8d6c153271f4.png)
    
3.  Go to External collaboration settings  
    ![](https://support.icompaas.com/assets/kb/706557c06a6beb8b.png)
    
4.  Set Guest users permissions are limited  
    ![](https://support.icompaas.com/assets/kb/67e5b01e8c79e70f.png)
    

### Backout Plan:

1.  Go to Azure Active Directory
    
2.  Go to External Identities
    
3.  Go to External collaboration settings
    
4.  Ensure that Guest users permissions are limited to Yes(how we can revoke the changes)
    

## **Note:**

Please note that at this point of time, there is no API/CLI mechanism available to programmatically conduct security assessment for this recommendation.

## **References:**

1.  **[](https://docs.microsoft.com/en-us/azure/active-directory/fundamentals/users-default-permissions#member-and-guest-users "https://docs.microsoft.com/en-us/azure/active-directory/fundamentals/users-default-permissions#member-and-guest-users")**[](https://docs.microsoft.com/en-us/azure/active-directory/fundamentals/users-default-permissions#member-and-guest-users "https://docs.microsoft.com/en-us/azure/active-directory/fundamentals/users-default-permissions#member-and-guest-users")[https://docs.microsoft.com/en-us/azure/active-directory/fundamentals/users- default-permissions#member-and-guest-users](https://docs.microsoft.com/en-us/azure/active-directory/fundamentals/users-default-permissions#member-and-guest-users "https://docs.microsoft.com/en-us/azure/active-directory/fundamentals/users-default-permissions#member-and-guest-users")
    
2.  [https://docs.microsoft.com/en-us/azure/security/benchmarks/security-controls- v2-privileged-access#pa-5-automate-entitlement-management](https://docs.microsoft.com/en-us/azure/security/benchmarks/security-controls-v2-privileged-access#pa-5-automate-entitlement-management "https://docs.microsoft.com/en-us/azure/security/benchmarks/security-controls-v2-privileged-access#pa-5-automate-entitlement-management")
    
3.  [https://docs.microsoft.com/en-us/azure/security/benchmarks/security-controls- v2-governance-strategy#gs-2-define-enterprise-segmentation-strategy](https://docs.microsoft.com/en-us/azure/security/benchmarks/security-controls-v2-governance-strategy#gs-2-define-enterprise-segmentation-strategy "https://docs.microsoft.com/en-us/azure/security/benchmarks/security-controls-v2-governance-strategy#gs-2-define-enterprise-segmentation-strategy")[](https://docs.microsoft.com/en-us/azure/security/benchmarks/security-controls-v2-governance-strategy#gs-2-define-enterprise-segmentation-strategy "https://docs.microsoft.com/en-us/azure/security/benchmarks/security-controls-v2-governance-strategy#gs-2-define-enterprise-segmentation-strategy")**[](https://docs.microsoft.com/en-us/azure/security/benchmarks/security-controls-v2-governance-strategy#gs-2-define-enterprise-segmentation-strategy "https://docs.microsoft.com/en-us/azure/security/benchmarks/security-controls-v2-governance-strategy#gs-2-define-enterprise-segmentation-strategy")**

## Related compliance guidance

- [SOC 2 compliance: a practical implementation guide for cloud-native SaaS teams](https://support.icompaas.com/compliance/soc-2-trust-services-criteria): Configuration checks like this one are the technical half of a SOC 2 / ISO 27001 programme — the guide shows where they fit, what else an auditor expects, and how to evidence them.
- [ISO/IEC 27001:2022 compliance: a practical implementation guide](https://support.icompaas.com/compliance/iso-27001-2022): ISO 27001 Annex A.8 (technological controls) is where cloud hardening evidence lands; the guide shows how to run the ISMS around it.