# (L2) Ensure guest user invitations are limited

(L2) Ensure guest user invitations are limited. A Maester check for Entra ID, External identities.

Source: https://maester.dev/docs/tests/CIS.M365.5.1.6.3

<!-- This file is generated by website/scripts/generate-test-docs.mjs. Do not edit manually. -->

<div class="test-byline"><div class="test-byline-avatars"><a class="test-byline-avatar test-byline-avatar--author" href="/contributors/jeremyfinney-lgtm" title="jeremy finney · Original author"><img src="https://github.com/JeremyFinney-lgtm.png" alt="jeremy finney" width="28" height="28" loading="lazy" decoding="async" /></a></div><div class="test-byline-meta"><span class="test-byline-text">Contributed by <a href="/contributors/jeremyfinney-lgtm">jeremy finney</a></span><a class="test-byline-link" href="/contributors">All contributors →</a></div></div>

<p class="test-part">Part of <a href="/docs/tests/cis">CIS</a> · Entra ID · External identities · <a href="/docs/tests">All checks</a></p>

```powershell title="Run this check"
Invoke-Maester -TestId CIS.M365.5.1.6.3
```

## Overview

5.1.6.3 (L2) Ensure guest user invitations are limited

By default, all users in the organization, including B2B collaboration guest users, can invite external users to B2B collaboration. The ability to send invitations can be limited by turning it on or off for everyone, or by restricting invitations to certain roles.

The recommended state is **Only users assigned to specific admin roles can invite guest users** or **No one in the organization can invite guest users including admins (most restrictive)**.

#### Rationale

Restricting who can invite guests limits the exposure the organization might face from unauthorized accounts. The default behavior allows anyone within the organization to invite guests and non-admins to the tenant, posing a security risk.

#### Impact

This introduces an obstacle to collaboration by restricting who can invite guest users to the organization. Designated Guest Inviters must be assigned, and an approval process established and clearly communicated to all users.

#### Remediation action

To remediate using the UI:

1. Navigate to Microsoft Entra admin center [https://entra.microsoft.com](https://entra.microsoft.com).
2. Expand **Entra ID** > **External Identities** and select **External collaboration settings**.
3. Under **Guest invite settings** set **Guest invite restrictions** to one of the following:
   - **Only users assigned to specific admin roles can invite guest users**
   - **No one in the organization can invite guest users including admins (most restrictive)**
4. Select **Save**.

##### PowerShell

1. Connect to Microsoft Graph using `Connect-MgGraph -Scopes 'Policy.ReadWrite.Authorization'`.
2. Run one of the following PowerShell commands depending on the desired state:

To set **Only users assigned to specific admin roles can invite guest users**:

```powershell
Update-MgPolicyAuthorizationPolicy -AllowInvitesFrom 'adminsAndGuestInviters'
```

To set **No one in the organization can invite guest users including admins (most restrictive)**:

```powershell
Update-MgPolicyAuthorizationPolicy -AllowInvitesFrom 'none'
```

> **Note:** The default value is **Anyone in the organization can invite guest users including guests and non-admins (most inclusive)**, shown as `everyone` in PowerShell.

#### Related links

* [Microsoft Entra admin center - External collaboration settings](https://entra.microsoft.com/#view/Microsoft_AAD_IAM/CompanyRelationshipsMenuBlade/~/Settings/menuId/Settings)
* [Configure external collaboration settings](https://learn.microsoft.com/entra/external-id/external-collaboration-settings-configure)
* [CIS Microsoft 365 Foundations Benchmark v7.0.0 - 5.1.6.3](https://www.cisecurity.org/benchmark/microsoft_365)

## Details

<details>
<summary>Every attribute of this check</summary>

| Field | Value |
| --- | --- |
| Test ID | CIS.M365.5.1.6.3 |
| Severity | Medium |
| Suite | CIS |
| Product | Entra ID |
| Feature | External identities |
| Area | External access and sharing |
| Resource type | Tenant |
| User impact | Medium |
| Implementation cost | Low |
| MITRE ATT&CK | T1136.003 Cloud Account |
| Supports benchmark | CIS Microsoft 365 Foundations Benchmark (version 7.0.0), requirement 5.1.6.3 |
| Benchmark level | L2 |
| Benchmark profiles | E3 Level 2 |
| Supports controls | cis-m365:5.1.6.3, nist-800-53-r5:AC-2 |
| PowerShell test | [Test-MtCisGuestInvitationsLimited](https://github.com/maester365/maester/blob/main/tests/cis/Test.CIS.M365.5.1.6.3.ps1) |
| Services | Graph |

</details>

## Source

- Test: [`tests/cis/Test.CIS.M365.5.1.6.3.ps1`](https://github.com/maester365/maester/blob/main/tests/cis/Test.CIS.M365.5.1.6.3.ps1)
- Documentation: [`tests/cis/Test.CIS.M365.5.1.6.3.md`](https://github.com/maester365/maester/blob/main/tests/cis/Test.CIS.M365.5.1.6.3.md)