cirsec Baselines
Esc
Microsoft 365 tenant · Directory, guests & tenant settings

Restrict guest access to their own directory objects

When it fails: Guests can enumerate users and groups in the directory. A guest account, which may be compromised in its home organization, can list the tenant's users, groups and memberships.

CB-M365-TENANT-010mediumactivemanualprofile baseline

Description

Guest user access restrictions is set to Guest user access is restricted to properties and memberships of their own directory objects (most restrictive) (guestUserRoleId = 2af84b1e-32c8-42b7-82bc-daa82404023b). Guests can read their own profile only; they cannot list other users, groups or group memberships.

Rationale

The organization does not control how guests authenticate in their home tenant. A compromised guest account with directory read access gives an attacker the full list of employees, groups and managers, which feeds phishing and privilege escalation. Collaboration in Teams and SharePoint keeps working with the most restrictive level.

Impact

Guests cannot browse the people picker beyond the people they already work with, and cannot see the members of groups they belong to in some apps. Teams and SharePoint collaboration is not affected.

Setting

LocationMicrosoft Entra admin center > Entra ID > External Identities > External collaboration settings > Guest user access restrictions
DefaultGuest users have limited access to properties and memberships of directory objects
RecommendedGuest user access is restricted to properties and memberships of their own directory objects (most restrictive)

Audit

  1. Sign in to the Microsoft Entra admin center (https://entra.microsoft.com) as at least a Global Reader.
  2. Browse to Entra ID > External Identities > External collaboration settings (the same option also appears in Entra ID > Users > User settings) and read Guest user access restrictions.
  3. Read-only PowerShell alternative (Microsoft Graph, scope Policy.Read.All): (Get-MgPolicyAuthorizationPolicy).GuestUserRoleId.
  4. Fail if the value is not 2af84b1e-32c8-42b7-82bc-daa82404023b.

Remediation

  1. Sign in to the Microsoft Entra admin center as at least an External Identity Provider Administrator (or Global Administrator).
  2. Browse to Entra ID > External Identities > External collaboration settings.
  3. Under Guest user access restrictions, select Guest user access is restricted to properties and memberships of their own directory objects (most restrictive) and Save.
  4. Equivalent with Microsoft Graph PowerShell (scope Policy.ReadWrite.Authorization): Update-MgPolicyAuthorizationPolicy -GuestUserRoleId '2af84b1e-32c8-42b7-82bc-daa82404023b'.

Rollback

Select Guest users have limited access to properties and memberships of directory objects (10dae51f-b6af-4016-8d66-8c2a99b929b3).

References

Mappings

FrameworkIDRelationNote
NIST SP 800-53 Rev. 55.1.1AC-3related
NIST SP 800-53 Rev. 55.1.1AC-6related
CISA SCuBA Microsoft 365 Secure Configuration Baselines2.0.0MS.AAD.8.1v1stricterSCuBA accepts limited or restricted access; ours requires restricted.

How this control relates to the other framework's: equivalent, stricter, looser, partial or related.

Threats mitigated

TaxonomyID
MITRE ATT&CKT1087.004

People and lifecycle

Authors
Introduced inv0.1.0
Created, updated2026-10-24, 2026-10-24
Translationsfr