Guest access should be restricted

High Azure General tenantsecurity-guest-access-restricted

Applies to

Microsoft.Graph/tenantSecurity

What CGPulse checks

A resource passes this rule when guestAccess.restrictionLevel must be one of ["limited","restricted"]. Anything else is reported as a finding with the evaluated property value attached as evidence.

How to fix it

Restrict guest user permissions to prevent directory enumeration. In Azure Portal: Entra ID > External identities > External collaboration settings > restrict guest access. See: https://learn.microsoft.com/en-us/entra/external-id/external-collaboration-settings-configure

CLI

az rest --method GET --url "https://graph.microsoft.com/v1.0/policies/authorizationPolicy" --query "guestUserRoleId" -o tsv

Terraform

# Entra ID configuration - use AzureAD provider
# resource "azuread_authorization_policy" "example" {
#   guest_user_role_id = "2af84b1e-32c8-42b7-82bc-daa82404023b"
#   # Restricted guest access role ID
# }

Compliance frameworks

Vendor documentation

Is your environment compliant with this rule?

CGPulse checks it — and 621 others — against your Azure and AWS accounts with read-only access.

Run a free scan