CISA.MS.AAD.8.1 - Guest users SHOULD have limited or restricted access to Entra ID directory objects.

Contributed by Michael Soule with Merill FernandoAll contributors →

Overview

Guest users SHOULD have limited or restricted access to Azure AD directory objects.

Rationale: Limiting the amount of object information available to guest users in the tenant, reduces malicious reconnaissance exposure, should a guest account become compromised or be created by an adversary.

Remediation action

1. In Entra ID and External Identities, select External collaboration settings.
2. Under Guest user access, select either Guest users have limited access to properties and memberships of directory objects or Guest user access is restricted to properties and memberships of their own directory objects (most restrictive).
3. Click Save.

Related links

• Entra admin center - External Identities | External collaboration settings
• CISA Guest User Access - MS.AAD.8.1v1
• CISA ScubaGear Rego Reference

Test Metadata

Field	Value
Test ID	CISA.MS.AAD.8.1
Severity	Medium
Suite	CISA
Product	Entra ID
Feature	External identities
Area	External access and sharing
Resource type	Tenant
User impact	Low
Implementation cost	Low
MITRE ATT&CK	T1087.003 Email Account, T1087.004 Cloud Account, T1526 Cloud Service Discovery, T1069.003 Cloud Groups
Supports benchmark	CISA SCuBA Secure Configuration Baselines for Microsoft 365 (version ScubaGear main, 2026-10-11), requirement MS.AAD.8.1
Criticality	SHOULD
Upstream requirement	MS.AAD.8.1v1
Supports controls	cisa-scuba:MS.AAD.8.1, nist-800-53-r5:AC-6
PowerShell test	Test-MtCisaGuestUserAccess
Services	Graph

Source

• Test: tests/cisa/entra/Test.CISA.MS.AAD.8.1.ps1
• Documentation: tests/cisa/entra/Test.CISA.MS.AAD.8.1.md