# Guests have restricted access to directory objects
External user accounts are often used to provide access to business partners who belong to organizations that have a business relationship with your…
Source: https://maester.dev/docs/tests/ZTA.21792
## Overview
External user accounts are often used to provide access to business partners who belong to organizations that have a business relationship with your enterprise. If these accounts are compromised in their organization, attackers can use the valid credentials to gain initial access to your environment, often bypassing traditional defenses due to their legitimacy.
External accounts with permissions to read directory object permissions provide attackers with broader initial access if compromised. These accounts allow attackers to gather additional information from the directory for reconnaissance.
## Remediation
- [Restrict guest access to their own directory objects](https://learn.microsoft.com/entra/external-id/external-collaboration-settings-configure?wt.mc_id=zerotrustrecommendations_automation_content_cnl_csasci#to-configure-guest-user-access)
## Run it
The check runs as part of the whole assessment, with the ZeroTrustAssessment module installed:
```powershell
Install-Module ZeroTrustAssessment -Scope CurrentUser
Connect-Maester
Invoke-Maester -Pack ZTA -SkipBuiltIn
```
Leave out `-SkipBuiltIn` to run Maester's own checks in the same run.
About this check
| | |
| --- | --- |
| Severity | Medium |
| Effort to fix | Low |
| Impact on users | Medium |
| Pillar | Identity |
| Category | External collaboration |
| Product | [Entra ID](/docs/tests/products/entra) |
| Feature | External identities |
| Area | External access and sharing |
| ATT&CK | [T1087.004](/docs/tests?mitre=T1087.004) Cloud Account, [T1069.003](/docs/tests?mitre=T1069.003) Cloud Groups |
| Licence | Free |
| Tenant | Workforce |
Product, feature, area and ATT&CK are Maester's: the assessment does not record them, so Maester keeps them in the pack's `taxonomy.json`.