Only users with the Guest Inviter role SHOULD be able to invite guest users

Contributed by Michael Soule with 2 co-contributorsAll contributors →

Part of CISA · Entra ID · External identities · All checks

Run this check

Invoke-Maester -TestId CISA.MS.AAD.8.2

Overview

Only users with the Guest Inviter role SHOULD be able to invite guest users.

Rationale: By only allowing an authorized group of individuals to invite external users to create accounts in the tenant, an agency can enforce a guest user account approval process, reducing the risk of unauthorized account creation.

Remediation action:

1. In Entra ID and External Identities, select External collaboration settings.

2. Under Guest invite settings, select Only users assigned to specific admin roles can invite guest users or No one in the organization can invite guest users including admins (most restrictive).

3. Click Save.

Related links

• Entra admin center - External Identities | External collaboration settings
• CISA Guest User Access - MS.AAD.8.2v1
• CISA ScubaGear Rego Reference

Details

Every attribute of this check

Field	Value
Test ID	CISA.MS.AAD.8.2
Severity	Medium
Suite	CISA
Product	Entra ID
Feature	External identities
Area	External access and sharing
Resource type	Tenant
User impact	Medium
Implementation cost	Low
MITRE ATT&CK	T1098.003 Additional Cloud Roles, T1136.003 Cloud Account
Supports benchmark	CISA SCuBA Secure Configuration Baselines for Microsoft 365 (version ScubaGear main, 2026-10-11), requirement MS.AAD.8.2
Criticality	SHOULD
Upstream requirement	MS.AAD.8.2v1
Supports controls	cisa-scuba:MS.AAD.8.2, nist-800-53-r5:AC-6(10)
PowerShell test	Test-MtCisaGuestInvitation
Services	Graph

Source

• Test: tests/cisa/entra/Test.CISA.MS.AAD.8.2.ps1
• Documentation: tests/cisa/entra/Test.CISA.MS.AAD.8.2.md