{
  "id": "CB-M365-TENANT-010",
  "standard": "m365",
  "version": "main",
  "url": "https://baselines.cirsec.org/b/m365/CB-M365-TENANT-010",
  "json": "https://baselines.cirsec.org/b/m365/CB-M365-TENANT-010.json",
  "yaml": "https://baselines.cirsec.org/b/m365/CB-M365-TENANT-010.yml",
  "profiles_effective": [
    "baseline",
    "hardened"
  ],
  "license": "Text CC BY 4.0, code Apache-2.0",
  "attribution": "CIRSEC Baselines, https://baselines.cirsec.org",
  "control": {
    "id": "CB-M365-TENANT-010",
    "title": "Restrict guest access to their own directory objects",
    "finding": {
      "title": "Guests can enumerate users and groups in the directory",
      "description": "A guest account, which may be compromised in its home organization, can list the tenant's users, groups and memberships."
    },
    "status": "active",
    "profiles": [
      "baseline"
    ],
    "risk": {
      "severity": "medium"
    },
    "assessment": "manual",
    "tags": [
      "entra-id",
      "guests",
      "external-identities",
      "reconnaissance"
    ],
    "setting": {
      "location": "Microsoft Entra admin center > Entra ID > External Identities > External collaboration settings > Guest user access restrictions",
      "default_value": "Guest users have limited access to properties and memberships of directory objects",
      "recommended_value": "Guest user access is restricted to properties and memberships of their own directory objects (most restrictive)"
    },
    "description": "**Guest user access restrictions** is set to **Guest user access is restricted to properties and\nmemberships of their own directory objects (most restrictive)** (`guestUserRoleId` =\n`2af84b1e-32c8-42b7-82bc-daa82404023b`). Guests can read their own profile only; they cannot list\nother users, groups or group memberships.\n",
    "rationale": "The organization does not control how guests authenticate in their home tenant. A compromised\nguest account with directory read access gives an attacker the full list of employees, groups\nand managers, which feeds phishing and privilege escalation. Collaboration in Teams and\nSharePoint keeps working with the most restrictive level.\n",
    "impact": "Guests cannot browse the people picker beyond the people they already work with, and cannot see\nthe members of groups they belong to in some apps. Teams and SharePoint collaboration is not\naffected.\n",
    "audit": {
      "manual": "1. Sign in to the Microsoft Entra admin center (https://entra.microsoft.com) as at least a\n   Global Reader.\n2. Browse to **Entra ID** > **External Identities** > **External collaboration settings** (the\n   same option also appears in **Entra ID** > **Users** > **User settings**) and read **Guest\n   user access restrictions**.\n3. Read-only PowerShell alternative (Microsoft Graph, scope `Policy.Read.All`):\n   `(Get-MgPolicyAuthorizationPolicy).GuestUserRoleId`.\n4. Fail if the value is not `2af84b1e-32c8-42b7-82bc-daa82404023b`.\n"
    },
    "remediation": {
      "manual": "1. Sign in to the Microsoft Entra admin center as at least an External Identity Provider\n   Administrator (or Global Administrator).\n2. Browse to **Entra ID** > **External Identities** > **External collaboration settings**.\n3. Under **Guest user access restrictions**, select **Guest user access is restricted to\n   properties and memberships of their own directory objects (most restrictive)** and\n   **Save**.\n4. Equivalent with Microsoft Graph PowerShell (scope `Policy.ReadWrite.Authorization`):\n   `Update-MgPolicyAuthorizationPolicy -GuestUserRoleId '2af84b1e-32c8-42b7-82bc-daa82404023b'`.\n",
      "rollback": "Select **Guest users have limited access to properties and memberships of directory objects**\n(`10dae51f-b6af-4016-8d66-8c2a99b929b3`).\n"
    },
    "references": [
      {
        "title": "Configure external collaboration settings",
        "url": "https://learn.microsoft.com/entra/external-id/external-collaboration-settings-configure",
        "publisher": "Microsoft",
        "kind": "vendor-doc",
        "accessed": "2026-10-24"
      },
      {
        "title": "What are the default user permissions in Microsoft Entra ID?",
        "url": "https://learn.microsoft.com/entra/fundamentals/users-default-permissions",
        "publisher": "Microsoft",
        "kind": "vendor-doc",
        "accessed": "2026-10-24"
      },
      {
        "title": "CISA SCuBA Microsoft Entra ID baseline",
        "url": "https://github.com/cisagov/ScubaGear/blob/main/PowerShell/ScubaGear/baselines/aad.md",
        "publisher": "CISA",
        "kind": "standard",
        "accessed": "2026-10-24"
      }
    ],
    "mappings": [
      {
        "framework": "cisa-scuba-m365",
        "framework_version": "2.0.0",
        "id": "MS.AAD.8.1v1",
        "relation": "stricter",
        "note": "SCuBA accepts limited or restricted access; ours requires restricted."
      },
      {
        "framework": "nist-800-53r5",
        "framework_version": "5.1.1",
        "id": "AC-3",
        "relation": "related"
      },
      {
        "framework": "nist-800-53r5",
        "framework_version": "5.1.1",
        "id": "AC-6",
        "relation": "related"
      }
    ],
    "threats": [
      {
        "framework": "mitre-attack",
        "id": "T1087.004"
      }
    ],
    "related_controls": [
      {
        "id": "CB-M365-TENANT-011",
        "type": "related"
      },
      {
        "id": "CB-M365-TENANT-013",
        "type": "related"
      },
      {
        "id": "CB-M365-POWER-010",
        "type": "related"
      },
      {
        "id": "CB-M365-POWER-012",
        "type": "related"
      }
    ],
    "authors": [
      {
        "name": "Alice",
        "github": "Sn0wAlice"
      }
    ],
    "introduced_in": "0.1.0",
    "created": "2026-10-24",
    "updated": "2026-10-24"
  }
}