{
  "id": "CB-M365-TENANT-012",
  "standard": "m365",
  "version": "main",
  "url": "https://baselines.cirsec.org/b/m365/CB-M365-TENANT-012",
  "json": "https://baselines.cirsec.org/b/m365/CB-M365-TENANT-012.json",
  "yaml": "https://baselines.cirsec.org/b/m365/CB-M365-TENANT-012.yml",
  "profiles_effective": [
    "hardened"
  ],
  "license": "Text CC BY 4.0, code Apache-2.0",
  "attribution": "CIRSEC Baselines, https://baselines.cirsec.org",
  "control": {
    "id": "CB-M365-TENANT-012",
    "title": "Allow guest invitations only to approved domains",
    "finding": {
      "title": "Guests can be invited from any domain",
      "description": "Invitations can be sent to any external address, including consumer mailboxes and lookalike domains, so data can be shared with any organization."
    },
    "status": "active",
    "profiles": [
      "hardened"
    ],
    "risk": {
      "severity": "medium"
    },
    "assessment": "manual",
    "tags": [
      "entra-id",
      "guests",
      "invitations",
      "external-identities",
      "allow-list"
    ],
    "parameters": [
      {
        "name": "allowed_guest_domains",
        "type": "list",
        "description": "External domains whose users may be invited as guests (partners with a business relationship).",
        "default": []
      }
    ],
    "description": "**Collaboration restrictions** is set to **Allow invitations only to the specified domains (most\nrestrictive)**, and the list contains exactly the domains of `{{ allowed_guest_domains }}`.\nInvitations to any other domain, including consumer email providers, are refused.\n",
    "rationale": "An allow list limits guest accounts, and therefore sharing through Entra B2B, to organizations\nwith a business relationship. It blocks invitations to personal mailboxes used to exfiltrate\ndata, and to lookalike domains set up by attackers.\n",
    "impact": "Every new partner domain must be added before its users can be invited, which needs a request\nprocess. The list applies to new invitations; existing guests from other domains stay until they\nare reviewed (CB-M365-TENANT-013). Partners with several domains need each one listed.\n",
    "notes": "Cross-tenant access settings (CB-M365-TENANT-014) can also allow or block B2B collaboration per\nMicrosoft Entra tenant; the domain list here also covers external users without an Entra tenant.\n",
    "audit": {
      "manual": "1. Sign in to the Microsoft Entra admin center (https://entra.microsoft.com) as at least a\n   Global Reader.\n2. Browse to **Entra ID** > **External Identities** > **External collaboration settings**,\n   section **Collaboration restrictions**.\n3. Check that **Allow invitations only to the specified domains (most restrictive)** is\n   selected and that the domain list matches `{{ allowed_guest_domains }}`.\n4. Read-only alternative with Microsoft Graph (beta, scope `Policy.Read.All`):\n   `GET https://graph.microsoft.com/beta/policies/b2bManagementPolicies` and read\n   `InvitationsAllowedAndBlockedDomainsPolicy`.\n5. Fail if invitations are allowed to any domain, if a deny list is used instead, or if the\n   list contains domains outside the parameter.\n"
    },
    "remediation": {
      "manual": "1. Collect the partner domains and set the parameter.\n2. With an External Identity Provider Administrator or Global Administrator, browse to\n   **Entra ID** > **External Identities** > **External collaboration settings**.\n3. Under **Collaboration restrictions**, select **Allow invitations only to the specified\n   domains (most restrictive)**, enter one domain per line and **Save**.\n",
      "rollback": "Select **Allow invitations to be sent to any domain (most inclusive)**.\n"
    },
    "references": [
      {
        "title": "Allow or block invitations to B2B users from specific organizations",
        "url": "https://learn.microsoft.com/entra/external-id/allow-deny-list",
        "publisher": "Microsoft",
        "kind": "vendor-doc",
        "accessed": "2026-10-24"
      },
      {
        "title": "CISA SCuBA Microsoft Entra ID baseline",
        "url": "https://github.com/cisagov/ScubaGear/blob/main/PowerShell/ScubaGear/baselines/aad.md",
        "publisher": "CISA",
        "kind": "standard",
        "accessed": "2026-10-24"
      }
    ],
    "mappings": [
      {
        "framework": "cisa-scuba-m365",
        "framework_version": "2.0.0",
        "id": "MS.AAD.8.3v1",
        "relation": "equivalent"
      },
      {
        "framework": "nist-800-53r5",
        "framework_version": "5.1.1",
        "id": "AC-20",
        "relation": "related"
      },
      {
        "framework": "nist-800-53r5",
        "framework_version": "5.1.1",
        "id": "AC-2",
        "relation": "related"
      }
    ],
    "threats": [
      {
        "framework": "mitre-attack",
        "id": "T1567"
      }
    ],
    "related_controls": [
      {
        "id": "CB-M365-TENANT-011",
        "type": "related"
      },
      {
        "id": "CB-M365-TENANT-014",
        "type": "related"
      },
      {
        "id": "CB-M365-COLLAB-002",
        "type": "related"
      },
      {
        "id": "CB-M365-COLLAB-005",
        "type": "related"
      }
    ],
    "authors": [
      {
        "name": "Alice",
        "github": "Sn0wAlice"
      }
    ],
    "introduced_in": "0.1.0",
    "created": "2026-10-24",
    "updated": "2026-10-24"
  }
}