CISA.MS.AAD.8.2 - Only users with the Guest Inviter role SHOULD be able to invite guest users.

Contributed by Michael Soule with 2 co-contributorsAll contributors →

Overview

Only users with the Guest Inviter role SHOULD be able to invite guest users.

Rationale: By only allowing an authorized group of individuals to invite external users to create accounts in the tenant, an agency can enforce a guest user account approval process, reducing the risk of unauthorized account creation.

Remediation action:

1. In Entra ID and External Identities, select External collaboration settings.

2. Under Guest invite settings, select Only users assigned to specific admin roles can invite guest users or No one in the organization can invite guest users including admins (most restrictive).

3. Click Save.

Related links

• Entra admin center - External Identities | External collaboration settings
• CISA Guest User Access - MS.AAD.8.2v1
• CISA ScubaGear Rego Reference

Test Metadata

Field	Value
Test ID	CISA.MS.AAD.8.2
Severity	Medium
Suite	CISA
Product	Entra ID
Feature	External identities
Area	External access and sharing
Resource type	Tenant
User impact	Medium
Implementation cost	Low
MITRE ATT&CK	T1098.003 Additional Cloud Roles, T1136.003 Cloud Account
Supports benchmark	CISA SCuBA Secure Configuration Baselines for Microsoft 365 (version ScubaGear main, 2026-10-11), requirement MS.AAD.8.2
Criticality	SHOULD
Upstream requirement	MS.AAD.8.2v1
Supports controls	cisa-scuba:MS.AAD.8.2, nist-800-53-r5:AC-6(10)
PowerShell test	Test-MtCisaGuestInvitation
Services	Graph

Source

• Test: tests/cisa/entra/Test.CISA.MS.AAD.8.2.ps1
• Documentation: tests/cisa/entra/Test.CISA.MS.AAD.8.2.md