CIS.M365.5.3.2 - (L1) Ensure 'Access reviews' for guest users are configured
Overview
A recurring access review of guest users exists, repeats at least monthly and applies its decisions automatically.
Guest accounts are created for a project and then forgotten. Each one keeps its access, and the external organisation that owns the identity can change or lose control of it without you noticing. A regular access review asks the owners to confirm that each guest still needs access, and removes those who are not confirmed.
The review must repeat weekly or monthly, give reviewers no more than 14 days, send notifications and reminders, ask for a justification when access is approved, apply results automatically, deny access when no one responds and have no end date. Access reviews need Microsoft Entra ID Governance or Microsoft Entra ID P2 licences.
Remediation action
- Sign in to the Microsoft Entra admin center.
- Go to ID Governance > Access reviews and select New access review.
- Select Teams + Groups and choose All Microsoft 365 groups with guest users (or a selected set of groups).
- Under Scope, choose Guest users only.
- Set the reviewers, a Weekly or Monthly recurrence, a duration of 14 days or less and No end date.
- Under Upon completion settings, turn on Auto apply results to resource and set If reviewers don't respond to Remove access.
- Under Advanced settings, turn on Require reason on approval, Mail notifications and Reminders, then create the review.
Related links
- Microsoft Entra admin center - Access reviews
- Create an access review of groups and applications in Microsoft Entra ID
- Manage guest access with access reviews
- CIS Microsoft 365 Foundations Benchmark v7.0.0 - 5.3.2
Test Metadata
| Field | Value |
|---|---|
| Test ID | CIS.M365.5.3.2 |
| Severity | Medium |
| Suite | CIS |
| Product | Entra ID |
| Feature | Identity Governance |
| Area | External access and sharing |
| Resource type | Tenant |
| User impact | Medium |
| Implementation cost | Medium |
| MITRE ATT&CK | T1078.004 Cloud Accounts |
| Supports benchmark | CIS Microsoft 365 Foundations Benchmark (version 7.0.0), requirement 5.3.2 |
| Benchmark level | L1 |
| Benchmark profiles | E5 Level 1 |
| Supports controls | cis-m365:5.3.2, nist-800-53-r5:AC-2 |
| PowerShell test | Test-MtCisGuestAccessReviews |
| Services | Graph |
| Compatible licenses | AAD_PREMIUM_P2, Entra_Identity_Governance |
Source
- Test:
tests/cis/Test.CIS.M365.5.3.2.ps1 - Documentation:
tests/cis/Test.CIS.M365.5.3.2.md