Guest User Access Shall be restricted

Description

Ensure that only users with specific privileges can invite guest users to the tenant and that invites can only be sent to specific external domains. Ensure that guest users have limited access to Azure AD directory objects and that they are required to use MFA.

Policy

Only users with the Guest Inviter role should be able to invite guest users.
Guest invites should only be allowed to specific external domains that have been authorized by the agency for legitimate business purposes.
Guest users should have limited access to Azure AD directory objects
Guest users shall use MFA
Guest User Access is periodically reviewed

Licensing Considerations

All License models support the guest settings. Azure AD P1 is required to enforce MFA for Guest users via Conditional Access Can be purchased standalone or part of the following bundles:

Microsoft 365 Business Premium
EMS+ E3 or EMS + E5
Microsoft 365 E3
Microsoft 365 E5

Set Up Instructions

Under Guest user access, select Guest users have limited access to properties and memberships of directory objects
Under Guest invite settings, select Only users assigned to specific admin roles can invite guest users
Under Collaboration restrictions, select Allow invitations only to the specified domains (most restrictive). Select Target domains and enter the names of the external domains that have been authorized by the agency for guest user access.
Chose the “Require Multi-Factor authentication for guest access” setting
Leverage the sign-in logs to review guest user access

End-User Impact

Level: Medium

Users will not be able to invite guest users to the organization without the Guest Inviter role. A formal process should be put into place to request guest access for certain organizations or users.

Tips

Use the collaboration settings for external users who are not using Azure AD.

PowerShell Scripts

Videos

PreviousManaged Devices shall be required for authentication NextThe number of users with highly privileged roles shall be limited

Last updated 1 year ago

Policy

Only users with the Guest Inviter role should be able to invite guest users.

Guest invites should only be allowed to specific external domains that have been authorized by the agency for legitimate business purposes.

Guest users should have limited access to Azure AD directory objects

Guest users shall use MFA

Guest User Access is periodically reviewed

Set Up Instructions

Configure guest settings in the portal:

Under Guest user access, select Guest users have limited access to properties and memberships of directory objects

Under Guest invite settings, select Only users assigned to specific admin roles can invite guest users

Under Collaboration restrictions, select Allow invitations only to the specified domains (most restrictive). Select Target domains and enter the names of the external domains that have been authorized by the agency for guest user access.

Create a Conditional Access Policy with the

Chose the “Require Multi-Factor authentication for guest access” setting

Leverage the sign-in logs to review guest user access

End-User Impact

Level: Medium

Users will not be able to invite guest users to the organization without the Guest Inviter role. A formal process should be put into place to request guest access for certain organizations or users.

Tips

Use the collaboration settings for external users who are not using Azure AD.

Use for external users in another Azure AD environment.