# Guest access is properly restricted

- Source: https://support.icompaas.com/support/solutions/articles/a_1781206753230199-guest-access-is-properly-restricted
- Section: [Solutions](https://support.icompaas.com/support/solutions) › [Identity Provider (IDP)](https://support.icompaas.com/support/solutions/c_1781206270516942) › [Microsoft 365 (MS365)](https://support.icompaas.com/support/solutions/folders/f_1781206551953491)
- Last updated: 2026-06-12
- Publisher: iCompaas, Inc. (https://www.icompaas.com)

Description:  
This control ensures that guest access within Microsoft 365 is restricted according to organizational security requirements. Properly restricting guest access helps prevent unauthorized access to organizational resources, data, and collaboration environments while allowing controlled external collaboration.

  

Rationale:  
Guest users may require limited access to specific resources for business collaboration. Restricting guest access reduces the risk of data exposure, unauthorized access, and excessive permissions while maintaining secure collaboration with external parties.

  

Impact:

-   Reduces the risk of unauthorized access to organizational resources.
    
-   Limits external user access to approved services and data.
    
-   Improves control over external collaboration activities.
    
-   Supports compliance requirements related to access control and data protection.
    
-   May restrict collaboration options available to external users.
    

  

Default Value:  
Guest access is enabled with default permissions. Administrators must explicitly configure guest access restrictions according to organizational requirements.

  

Remediation

Test Plan

1.  Sign in to the Microsoft Entra admin center with administrative privileges.
    
2.  Navigate to Identity → External Identities → External collaboration settings.
    
3.  Review the guest user access restrictions.
    
4.  Verify that guest access is restricted according to organizational policy.
    
5.  Create or identify a guest user account.
    
6.  Attempt to access organizational resources using the guest account.
    
7.  Verify that access is limited to approved resources and services.
    
8.  If guest access is not properly restricted, follow the Implementation Plan to remediate the issue and repeat the test.
    

  

Implementation Steps:

1.  Sign in to the Microsoft Entra admin center with Global Administrator privileges.
    
2.  Navigate to Identity → External Identities → External collaboration settings.
    
3.  Under Guest user access restrictions, select Guest users have limited access to properties and memberships of directory objects or a more restrictive setting according to organizational policy.
    
4.  Configure Guest invite restrictions to limit who can invite guest users.
    
5.  Restrict guest access permissions as required by organizational policy.
    
6.  Click Save to apply the configuration changes.
    
7.  Review existing guest accounts and remove any that are no longer required.
    
8.  Verify that guest users have access only to approved resources and services.
    
9.  Verify that guest access restrictions are enforced across the organization.
    

  

Backout Plan:

1.  Sign in to the Microsoft Entra admin center with Global Administrator privileges.
    
2.  Navigate to Identity → External Identities → External collaboration settings.
    
3.  Modify the guest user access restrictions as required.
    
4.  Adjust guest invite permissions according to operational requirements.
    
5.  Click Save to apply the configuration changes.
    
6.  Verify that guest access functions according to the updated configuration.
    

  

References:

-   [Microsoft Entra External Collaboration Settings Documentation](https://learn.microsoft.com/en-us/entra/external-id/external-collaboration-settings-configure)
    
-   [Microsoft Entra B2B Collaboration Documentation](https://learn.microsoft.com/en-us/entra/external-id/what-is-b2b)
    
-   [Microsoft Entra External Identities Documentation  
      
    ](https://learn.microsoft.com/en-us/entra/external-id/overview-external-identities)

## Related compliance guidance

- [SOC 2 compliance: a practical implementation guide for cloud-native SaaS teams](https://support.icompaas.com/compliance/soc-2-trust-services-criteria): Configuration checks like this one are the technical half of a SOC 2 / ISO 27001 programme — the guide shows where they fit, what else an auditor expects, and how to evidence them.
- [ISO/IEC 27001:2022 compliance: a practical implementation guide](https://support.icompaas.com/compliance/iso-27001-2022): ISO 27001 Annex A.8 (technological controls) is where cloud hardening evidence lands; the guide shows how to run the ISMS around it.