{
  "id": "CB-M365-TENANT-013",
  "standard": "m365",
  "version": "main",
  "url": "https://baselines.cirsec.org/b/m365/CB-M365-TENANT-013",
  "json": "https://baselines.cirsec.org/b/m365/CB-M365-TENANT-013.json",
  "yaml": "https://baselines.cirsec.org/b/m365/CB-M365-TENANT-013.yml",
  "profiles_effective": [
    "baseline",
    "hardened"
  ],
  "license": "Text CC BY 4.0, code Apache-2.0",
  "attribution": "CIRSEC Baselines, https://baselines.cirsec.org",
  "control": {
    "id": "CB-M365-TENANT-013",
    "title": "Review guest access periodically",
    "finding": {
      "title": "Guest access is never reviewed",
      "description": "Guests keep their access to teams, groups and files long after the collaboration has ended."
    },
    "status": "active",
    "profiles": [
      "baseline"
    ],
    "risk": {
      "severity": "medium"
    },
    "assessment": "manual",
    "tags": [
      "guests",
      "access-reviews",
      "external-identities",
      "governance"
    ],
    "applicability": {
      "requires": [
        "Microsoft Entra ID P2"
      ]
    },
    "parameters": [
      {
        "name": "guest_review_frequency",
        "type": "enum",
        "description": "Recurrence of the guest access review.",
        "default": "quarterly",
        "allowed": [
          "weekly",
          "monthly",
          "quarterly"
        ]
      }
    ],
    "description": "A recurring access review covers the guest members of every Microsoft 365 group (and team), every\n`{{ guest_review_frequency }}`. The review:\n\n- targets **Guest users only** in **All Microsoft 365 groups with guest users**;\n- has internal reviewers (group owners, with a fallback reviewer), never the guests themselves;\n- enables mail notifications and reminders, and requires a reason on approval;\n- lasts 14 days or less and recurs with no end date;\n- applies results automatically and **removes access** when reviewers do not respond.\n",
    "rationale": "Guests are added for a project and rarely removed when it ends. A review that removes access by\ndefault when nobody vouches for the guest keeps the external population limited to active\ncollaborations, and documents who approved what.\n",
    "impact": "Owners review their guests each cycle; a missed review removes legitimate guests, who must be\ninvited again. Reviews of guests need Microsoft Entra ID Governance or P2 licensing, and Microsoft\nbills guest governance features through a linked Azure subscription.\n",
    "notes": "Guests removed from all groups can be blocked and then deleted with the review option **Block\nuser from signing-in for 30 days, then remove user from the tenant** in a separate review scoped\nto all guest users.\n",
    "audit": {
      "manual": "1. Sign in to the Microsoft Entra admin center (https://entra.microsoft.com) as at least a\n   Global Reader.\n2. Browse to **ID Governance** > **Access reviews** and open the reviews of **Teams + Groups**.\n3. Find an active review with scope **All Microsoft 365 groups with guest users** and **Guest\n   users only**, and check: reviewers are internal; **Frequency** `{{ guest_review_frequency }}`\n   or more frequent; **Duration** 14 days or less; **End** **Never**; **Mail\n   notifications**, **Reminders**, **Require reason on approval** and **Auto apply results to\n   resource** enabled; **If reviewers don't respond** **Remove access**.\n4. Read-only alternative with Microsoft Graph (scope `AccessReview.Read.All`):\n   `GET /identityGovernance/accessReviews/definitions` and look for a definition whose scope\n   filters `userType eq 'Guest'` across Microsoft 365 groups.\n5. Fail if no such review exists or if one criterion is not met.\n"
    },
    "remediation": {
      "manual": "1. With an Identity Governance Administrator, browse to **ID Governance** > **Access\n   reviews** > **New access review**.\n2. **Select what to review**: **Teams + Groups**; **Review scope**: **All Microsoft 365 groups\n   with guest users**; **Scope**: **Guest users only**.\n3. **Reviewers**: **Group owner(s)**, with a fallback reviewer.\n4. **Recurrence**: `{{ guest_review_frequency }}`, **Duration** 14 days or less, **End**\n   **Never**.\n5. **Upon completion settings**: **Auto apply results to resource** enabled; **If reviewers\n   don't respond**: **Remove access**.\n6. **Enable reviewer decision helpers** and, under **Advanced settings**, **Justification\n   required**, **Email notifications** and **Reminders**. Select **Create**.\n",
      "rollback": "Stop or delete the access review; removed guests must be invited again.\n"
    },
    "references": [
      {
        "title": "Manage guest access with access reviews",
        "url": "https://learn.microsoft.com/entra/id-governance/manage-guest-access-with-access-reviews",
        "publisher": "Microsoft",
        "kind": "vendor-doc",
        "accessed": "2026-10-24"
      },
      {
        "title": "Create an access review of groups and applications",
        "url": "https://learn.microsoft.com/entra/id-governance/create-access-review",
        "publisher": "Microsoft",
        "kind": "vendor-doc",
        "accessed": "2026-10-24"
      }
    ],
    "mappings": [
      {
        "framework": "nist-800-53r5",
        "framework_version": "5.1.1",
        "id": "AC-2",
        "relation": "related"
      },
      {
        "framework": "nist-800-53r5",
        "framework_version": "5.1.1",
        "id": "AC-2(3)",
        "relation": "related"
      }
    ],
    "related_controls": [
      {
        "id": "CB-M365-TENANT-010",
        "type": "related"
      },
      {
        "id": "CB-M365-ADMIN-012",
        "type": "related"
      },
      {
        "id": "CB-M365-COLLAB-011",
        "type": "related"
      }
    ],
    "authors": [
      {
        "name": "Alice",
        "github": "Sn0wAlice"
      }
    ],
    "introduced_in": "0.1.0",
    "created": "2026-10-24",
    "updated": "2026-10-24"
  }
}