Restrict guest invitations to administrators and Guest Inviters

Description

Guest invite restrictions is set to Only users assigned to specific admin roles can invite guest users (allowInvitesFrom = adminsAndGuestInviters), or to No one in the organization can invite guest users including admins (most restrictive) (none). Invitations come from User Administrators and from people given the Guest Inviter role, or from a governed process such as entitlement management.

SharePoint and OneDrive sharing with new external people also creates guests through Entra B2B integration, and is subject to this setting.

Rationale

Each guest is an account whose authentication the organization does not control. When anyone can invite, guests accumulate without a sponsor, a purpose or a review, and an attacker with a compromised member account can invite their own external account to keep access.

Impact

Users who invite partners directly from Teams, SharePoint or Outlook can no longer do so: the request goes through a Guest Inviter, the service desk or an access package. With strong external collaboration, assign the Guest Inviter role to enough people per department.

Setting

Audit

1. Sign in to the Microsoft Entra admin center (https://entra.microsoft.com) as at least a Global Reader.
2. Browse to Entra ID > External Identities > External collaboration settings and read Guest invite restrictions.
3. Read-only PowerShell alternative (Microsoft Graph, scope Policy.Read.All): (Get-MgPolicyAuthorizationPolicy).AllowInvitesFrom.
4. Fail if the value is everyone or adminsGuestInvitersAndAllMembers.

Remediation

1. Assign the Guest Inviter role to the people who invite partners on behalf of their teams (Entra ID > Roles & admins > Guest Inviter).
2. With an External Identity Provider Administrator or Global Administrator, browse to Entra ID > External Identities > External collaboration settings.
3. Under Guest invite restrictions, select Only users assigned to specific admin roles can invite guest users and Save.
4. Equivalent with Microsoft Graph PowerShell (scope Policy.ReadWrite.Authorization): Update-MgPolicyAuthorizationPolicy -AllowInvitesFrom 'adminsAndGuestInviters'.

Rollback

Select Member users and users assigned to specific admin roles can invite guest users including guests with member permissions.

References

• Configure external collaboration settings Microsoft, vendor-doc, accessed 2026-10-24
• CISA SCuBA Microsoft Entra ID baseline CISA, standard, accessed 2026-10-24

Mappings

How this control relates to the other framework's: equivalent, stricter, looser, partial or related.

Threats mitigated

Related controls

• related CB-M365-TENANT-009 Disable self-service sign-up to the tenant
• related CB-M365-TENANT-010 Restrict guest access to their own directory objects
• related CB-M365-TENANT-012 Allow guest invitations only to approved domains
• related CB-M365-COLLAB-002 Enable SharePoint and OneDrive integration with Microsoft Entra B2B
• related CB-M365-COLLAB-003 Restrict SharePoint external sharing to authenticated guests
• related CB-M365-POWER-011 Restrict guest invitations through Fabric sharing

People and lifecycle