{
  "id": "CB-M365-TENANT-011",
  "standard": "m365",
  "version": "main",
  "url": "https://baselines.cirsec.org/b/m365/CB-M365-TENANT-011",
  "json": "https://baselines.cirsec.org/b/m365/CB-M365-TENANT-011.json",
  "yaml": "https://baselines.cirsec.org/b/m365/CB-M365-TENANT-011.yml",
  "profiles_effective": [
    "hardened"
  ],
  "license": "Text CC BY 4.0, code Apache-2.0",
  "attribution": "CIRSEC Baselines, https://baselines.cirsec.org",
  "control": {
    "id": "CB-M365-TENANT-011",
    "title": "Restrict guest invitations to administrators and Guest Inviters",
    "finding": {
      "title": "Any user, or even guests, can invite external users",
      "description": "Every member, and by default every guest, can bring external accounts into the tenant without any review."
    },
    "status": "active",
    "profiles": [
      "hardened"
    ],
    "risk": {
      "severity": "medium"
    },
    "assessment": "manual",
    "tags": [
      "entra-id",
      "guests",
      "invitations",
      "external-identities"
    ],
    "setting": {
      "location": "Microsoft Entra admin center > Entra ID > External Identities > External collaboration settings > Guest invite restrictions",
      "default_value": "Anyone in the organization can invite guest users including guests and non-admins (most inclusive)",
      "recommended_value": "Only users assigned to specific admin roles can invite guest users"
    },
    "description": "**Guest invite restrictions** is set to **Only users assigned to specific admin roles can invite\nguest users** (`allowInvitesFrom` = `adminsAndGuestInviters`), or to **No one in the\norganization can invite guest users including admins (most restrictive)** (`none`). Invitations\ncome from User Administrators and from people given the Guest Inviter role, or from a governed\nprocess such as entitlement management.\n",
    "rationale": "Each guest is an account whose authentication the organization does not control. When anyone\ncan invite, guests accumulate without a sponsor, a purpose or a review, and an attacker with a\ncompromised member account can invite their own external account to keep access.\n",
    "impact": "Users who invite partners directly from Teams, SharePoint or Outlook can no longer do so: the\nrequest goes through a Guest Inviter, the service desk or an access package. With strong external\ncollaboration, assign the Guest Inviter role to enough people per department.\n",
    "notes": "SharePoint and OneDrive sharing with new external people also creates guests through Entra B2B\nintegration, and is subject to this setting.\n",
    "audit": {
      "manual": "1. Sign in to the Microsoft Entra admin center (https://entra.microsoft.com) as at least a\n   Global Reader.\n2. Browse to **Entra ID** > **External Identities** > **External collaboration settings** and\n   read **Guest invite restrictions**.\n3. Read-only PowerShell alternative (Microsoft Graph, scope `Policy.Read.All`):\n   `(Get-MgPolicyAuthorizationPolicy).AllowInvitesFrom`.\n4. Fail if the value is `everyone` or `adminsGuestInvitersAndAllMembers`.\n"
    },
    "remediation": {
      "manual": "1. Assign the Guest Inviter role to the people who invite partners on behalf of their teams\n   (**Entra ID** > **Roles & admins** > **Guest Inviter**).\n2. With an External Identity Provider Administrator or Global Administrator, browse to\n   **Entra ID** > **External Identities** > **External collaboration settings**.\n3. Under **Guest invite restrictions**, select **Only users assigned to specific admin roles\n   can invite guest users** and **Save**.\n4. Equivalent with Microsoft Graph PowerShell (scope `Policy.ReadWrite.Authorization`):\n   `Update-MgPolicyAuthorizationPolicy -AllowInvitesFrom 'adminsAndGuestInviters'`.\n",
      "rollback": "Select **Member users and users assigned to specific admin roles can invite guest users\nincluding guests with member permissions**.\n"
    },
    "references": [
      {
        "title": "Configure external collaboration settings",
        "url": "https://learn.microsoft.com/entra/external-id/external-collaboration-settings-configure",
        "publisher": "Microsoft",
        "kind": "vendor-doc",
        "accessed": "2026-10-24"
      },
      {
        "title": "CISA SCuBA Microsoft Entra ID baseline",
        "url": "https://github.com/cisagov/ScubaGear/blob/main/PowerShell/ScubaGear/baselines/aad.md",
        "publisher": "CISA",
        "kind": "standard",
        "accessed": "2026-10-24"
      }
    ],
    "mappings": [
      {
        "framework": "cisa-scuba-m365",
        "framework_version": "2.0.0",
        "id": "MS.AAD.8.2v1",
        "relation": "equivalent"
      },
      {
        "framework": "nist-800-53r5",
        "framework_version": "5.1.1",
        "id": "AC-2",
        "relation": "related"
      },
      {
        "framework": "nist-800-53r5",
        "framework_version": "5.1.1",
        "id": "AC-6",
        "relation": "related"
      }
    ],
    "threats": [
      {
        "framework": "mitre-attack",
        "id": "T1136.003"
      }
    ],
    "related_controls": [
      {
        "id": "CB-M365-TENANT-009",
        "type": "related"
      },
      {
        "id": "CB-M365-TENANT-010",
        "type": "related"
      },
      {
        "id": "CB-M365-TENANT-012",
        "type": "related"
      },
      {
        "id": "CB-M365-COLLAB-002",
        "type": "related"
      },
      {
        "id": "CB-M365-COLLAB-003",
        "type": "related"
      },
      {
        "id": "CB-M365-POWER-011",
        "type": "related"
      }
    ],
    "authors": [
      {
        "name": "Alice",
        "github": "Sn0wAlice"
      }
    ],
    "introduced_in": "0.1.0",
    "created": "2026-10-24",
    "updated": "2026-10-24"
  }
}