Description:
This control ensures that guest access within Microsoft 365 is restricted according to organizational security requirements. Properly restricting guest access helps prevent unauthorized access to organizational resources, data, and collaboration environments while allowing controlled external collaboration.
Rationale:
Guest users may require limited access to specific resources for business collaboration. Restricting guest access reduces the risk of data exposure, unauthorized access, and excessive permissions while maintaining secure collaboration with external parties.
Impact:
Reduces the risk of unauthorized access to organizational resources.
Limits external user access to approved services and data.
Improves control over external collaboration activities.
Supports compliance requirements related to access control and data protection.
May restrict collaboration options available to external users.
Default Value:
Guest access is enabled with default permissions. Administrators must explicitly configure guest access restrictions according to organizational requirements.
Remediation
Test Plan
Sign in to the Microsoft Entra admin center with administrative privileges.
Navigate to Identity → External Identities → External collaboration settings.
Review the guest user access restrictions.
Verify that guest access is restricted according to organizational policy.
Create or identify a guest user account.
Attempt to access organizational resources using the guest account.
Verify that access is limited to approved resources and services.
If guest access is not properly restricted, follow the Implementation Plan to remediate the issue and repeat the test.
Implementation Steps:
Sign in to the Microsoft Entra admin center with Global Administrator privileges.
Navigate to Identity → External Identities → External collaboration settings.
Under Guest user access restrictions, select Guest users have limited access to properties and memberships of directory objects or a more restrictive setting according to organizational policy.
Configure Guest invite restrictions to limit who can invite guest users.
Restrict guest access permissions as required by organizational policy.
Click Save to apply the configuration changes.
Review existing guest accounts and remove any that are no longer required.
Verify that guest users have access only to approved resources and services.
Verify that guest access restrictions are enforced across the organization.
Backout Plan:
Sign in to the Microsoft Entra admin center with Global Administrator privileges.
Navigate to Identity → External Identities → External collaboration settings.
Modify the guest user access restrictions as required.
Adjust guest invite permissions according to operational requirements.
Click Save to apply the configuration changes.
Verify that guest access functions according to the updated configuration.
References: