Do not assign privileged roles to guest users

Description

No guest user (userType Guest, or an external account with #EXT# in its user principal name) holds a privileged Microsoft Entra role, actively or as eligible, directly or through a group. External administrators (partners, contractors) get a named cloud-only account in the tenant (CB-M365-ADMIN-001) or a GDAP relationship (CB-M365-ADMIN-017).

Rationale

A guest authenticates in its home tenant or with a consumer account: its password policy, MFA, device and offboarding are out of the organization's control. When the guest's home account is compromised or its owner leaves the partner company, the privileged role stays reachable.

Impact

External administrators need an internal account with the same protections as employees, which adds an account to manage and a license where required.

Audit

1. Sign in to the Microsoft Entra admin center (https://entra.microsoft.com) as at least a Global Reader.
2. Browse to Entra ID > Roles & admins > Roles & admins, open each role marked Privileged > Assignments, and look for members with User type Guest (eligible and active, expanding groups).
3. Read-only PowerShell alternative (Microsoft Graph, scopes RoleManagement.Read.Directory, User.Read.All):

   $ids = (Get-MgRoleManagementDirectoryRoleAssignment -All).PrincipalId +
          (Get-MgRoleManagementDirectoryRoleEligibilitySchedule -All).PrincipalId
   $ids | Sort-Object -Unique | ForEach-Object { Get-MgUser -UserId $_ -Property UserPrincipalName,UserType -ErrorAction SilentlyContinue } |
     Where-Object UserType -eq 'Guest'
   

4. Fail if any guest holds a privileged role.

Remediation

1. With a Privileged Role Administrator, remove the role from the guest in Roles & admins or in Privileged Identity Management > Assignments.
2. If the person still needs administrative access, create a named cloud-only account, register phishing-resistant methods and assign the narrowest role as eligible.

Rollback

Reassign the role to the guest (not recommended).

References

• Best practices for Microsoft Entra roles Microsoft, vendor-doc, accessed 2026-10-24
• Securing privileged access for hybrid and cloud deployments in Microsoft Entra ID Microsoft, vendor-doc, accessed 2026-10-24

Mappings

How this control relates to the other framework's: equivalent, stricter, looser, partial or related.

Threats mitigated

Related controls

• related CB-M365-ADMIN-001 Use dedicated, named, cloud-only accounts for administrative roles
• related CB-M365-ADMIN-017 Limit partner administrative access with scoped, time-bound GDAP relationships
• related CB-M365-TENANT-013 Review guest access periodically

People and lifecycle