# yaml-language-server: $schema=../../../../schema/control.schema.json
id: CB-M365-TENANT-013
title: Review guest access periodically
finding:
  title: Guest access is never reviewed
  description: Guests keep their access to teams, groups and files long after the collaboration has ended.
status: active
profiles: [baseline]
risk:
  severity: medium
assessment: manual
tags: [guests, access-reviews, external-identities, governance]

applicability:
  requires:
    - "Microsoft Entra ID P2"

parameters:
  - name: guest_review_frequency
    type: enum
    description: Recurrence of the guest access review.
    default: quarterly
    allowed: [weekly, monthly, quarterly]

description: |
  A recurring access review covers the guest members of every Microsoft 365 group (and team), every
  `{{ guest_review_frequency }}`. The review:

  - targets **Guest users only** in **All Microsoft 365 groups with guest users**;
  - has internal reviewers (group owners, with a fallback reviewer), never the guests themselves;
  - enables mail notifications and reminders, and requires a reason on approval;
  - lasts 14 days or less and recurs with no end date;
  - applies results automatically and **removes access** when reviewers do not respond.
rationale: |
  Guests are added for a project and rarely removed when it ends. A review that removes access by
  default when nobody vouches for the guest keeps the external population limited to active
  collaborations, and documents who approved what.
impact: |
  Owners review their guests each cycle; a missed review removes legitimate guests, who must be
  invited again. Reviews of guests need Microsoft Entra ID Governance or P2 licensing, and Microsoft
  bills guest governance features through a linked Azure subscription.
notes: |
  Guests removed from all groups can be blocked and then deleted with the review option **Block
  user from signing-in for 30 days, then remove user from the tenant** in a separate review scoped
  to all guest users.

audit:
  manual: |
    1. Sign in to the Microsoft Entra admin center (https://entra.microsoft.com) as at least a
       Global Reader.
    2. Browse to **ID Governance** > **Access reviews** and open the reviews of **Teams + Groups**.
    3. Find an active review with scope **All Microsoft 365 groups with guest users** and **Guest
       users only**, and check: reviewers are internal; **Frequency** `{{ guest_review_frequency }}`
       or more frequent; **Duration** 14 days or less; **End** **Never**; **Mail
       notifications**, **Reminders**, **Require reason on approval** and **Auto apply results to
       resource** enabled; **If reviewers don't respond** **Remove access**.
    4. Read-only alternative with Microsoft Graph (scope `AccessReview.Read.All`):
       `GET /identityGovernance/accessReviews/definitions` and look for a definition whose scope
       filters `userType eq 'Guest'` across Microsoft 365 groups.
    5. Fail if no such review exists or if one criterion is not met.

remediation:
  manual: |
    1. With an Identity Governance Administrator, browse to **ID Governance** > **Access
       reviews** > **New access review**.
    2. **Select what to review**: **Teams + Groups**; **Review scope**: **All Microsoft 365 groups
       with guest users**; **Scope**: **Guest users only**.
    3. **Reviewers**: **Group owner(s)**, with a fallback reviewer.
    4. **Recurrence**: `{{ guest_review_frequency }}`, **Duration** 14 days or less, **End**
       **Never**.
    5. **Upon completion settings**: **Auto apply results to resource** enabled; **If reviewers
       don't respond**: **Remove access**.
    6. **Enable reviewer decision helpers** and, under **Advanced settings**, **Justification
       required**, **Email notifications** and **Reminders**. Select **Create**.
  rollback: |
    Stop or delete the access review; removed guests must be invited again.

references:
  - title: Manage guest access with access reviews
    url: https://learn.microsoft.com/entra/id-governance/manage-guest-access-with-access-reviews
    publisher: Microsoft
    kind: vendor-doc
    accessed: 2026-10-24
  - title: Create an access review of groups and applications
    url: https://learn.microsoft.com/entra/id-governance/create-access-review
    publisher: Microsoft
    kind: vendor-doc
    accessed: 2026-10-24
mappings:
  - framework: cis-m365
    framework_version: "7.0.0"
    id: "5.3.2"
    relation: looser
    note: Quarterly by default to match the privileged role reviews; CIS asks for a monthly review. Set the parameter to monthly to match it.
  - framework: nist-800-53r5
    framework_version: "5.1.1"
    id: AC-2
    relation: related
  - framework: nist-800-53r5
    framework_version: "5.1.1"
    id: AC-2(3)
    relation: related
related_controls:
  - id: CB-M365-TENANT-010
    type: related
  - id: CB-M365-ADMIN-012
    type: related
  - id: CB-M365-COLLAB-011
    type: related

authors:
  - name: Alice
    github: Sn0wAlice
introduced_in: 0.1.0
created: 2026-10-24
updated: 2026-10-24