EIDTNT-004: Guest Invitation Restrictions
- Platform
- Entra ID / M365
- Category
- Entra ID Tenant Configuration
- Severity
- Medium
- Zero Trust pillar
- Governance (weight 1)
- Golden fixtures
- 3
- Branch coverage
- Observed: fixtures prove the verdicts they exercise
- Provenance
- baseline
What it checks
Guest invitation settings control who can invite external users to the tenant, ranging from allowing any user to invite guests to restricting invitations to administrators only. Permissive invitation settings allow standard users to invite external parties without oversight, potentially introducing unvetted external identities with access to organizational resources. Invitation restrictions should align with the organization's external collaboration governance requirements.
Recommended value
Guest invitations restricted to users with specific admin roles or guest inviter role, with no self-service guest access enabled
Remediation
Navigate to Entra ID > External Identities > External collaboration settings and review the guest invite settings. Restrict guest invitations to users assigned the Guest Inviter role or specific administrator roles rather than allowing all members to invite. Disable the option for guests to invite other guests to prevent uncontrolled invitation chains and establish an approval workflow for guest invitation requests.
Fixture-proven verdicts
Every verdict below is proven by a golden fixture in the module's gating test suite. This table derives from the last green run; it cannot be edited by hand.
| Scenario | Expected verdict |
|---|---|
| clean | PASS |
| known-bad | FAIL |
| no-data | Not Assessed |
Framework mappings
- CISA SCuBA
- MS.AAD.8.2v1
- NIST SP 800-53
- AC-14
- CIS M365 Benchmark
- 1.3.1