EIDPIM-004: Privileged Role Assignments to Guest Users
- Platform
- Entra ID / M365
- Category
- Entra ID Privileged Identity Management
- Severity
- Critical
- Zero Trust pillar
- Identity (weight 2)
- Golden fixtures
- 4
- Branch coverage
- Observed: fixtures prove the verdicts they exercise
- Provenance
- baseline
What it checks
Guest or external users with privileged Entra ID role assignments present a significant supply chain and third-party risk. These accounts originate from external organizations and are not subject to the same security controls, password policies, or monitoring as internal accounts. A compromised guest account with administrative privileges can lead to full tenant compromise while being difficult to detect through normal internal security monitoring
Recommended value
No guest or external users assigned to any privileged Entra ID roles
Remediation
Review all privileged role assignments and identify any members with a userType of Guest. Remove privileged role assignments from all guest accounts immediately. If external administrative access is required, provision dedicated cloud-only accounts within the tenant under full organizational control instead of using guest invitations
Fixture-proven verdicts
Every verdict below is proven by a golden fixture in the module's gating test suite. This table derives from the last green run; it cannot be edited by hand.
| Scenario | Expected verdict |
|---|---|
| clean | PASS |
| known-bad | FAIL |
| partial-collection | Not Assessed |
| throttled | Not Assessed |
Framework mappings
- NIST SP 800-53
- AC-6(5), IA-8
- CIS M365 Benchmark
- 1.1.2
- MITRE ATT&CK
- T1078.004