CISA.MS.AAD.8.3 - Guest invites SHOULD only be allowed to specific external domains that have been authorized by the agency for legitimate business purposes.
Overview
Guest invites SHOULD only be allowed to specific external domains that have been authorized by the agency for legitimate business purposes.
Rationale: Limiting which domains can be invited to create guest accounts in the tenant helps reduce the risk of users from unauthorized external organizations getting access.
⚠️ WARNING: This test utilizes a technical mechanism that differs from CISA's, though the outcome is the same.
Remediation action:
- In Entra admin center select External Identities and Cross-tenant access settings.
- Under Default settings, select Edit inbound defaults.
- Under B2B collaboration, and External users and groups, ensure Access status is set to Block access.
- Under B2B collaboration, and Applications, ensure Access status is set to Block access.
This configuration will only allow B2B collaboration with other Entra tenants.
Related links
- Entra admin center - External Identities | Cross-tenant access settings
- CISA 8 Guest User Access - MS.AAD.8.3v1
- CISA ScubaGear Rego Reference
Test Metadata
| Field | Value |
|---|---|
| Test ID | CISA.MS.AAD.8.3 |
| Severity | Medium |
| Suite | CISA |
| Product | Entra ID |
| Feature | External identities |
| Area | External access and sharing |
| Resource type | Tenant |
| User impact | Medium |
| Implementation cost | Medium |
| MITRE ATT&CK | T1078.004 Cloud Accounts |
| Supports benchmark | CISA SCuBA Secure Configuration Baselines for Microsoft 365 (version ScubaGear main, 2026-10-11), requirement MS.AAD.8.3 |
| Criticality | SHOULD |
| Upstream requirement | MS.AAD.8.3v1 |
| Supports controls | cisa-scuba:MS.AAD.8.3, nist-800-53-r5:AC-3 |
| PowerShell test | Test-MtCisaCrossTenantInboundDefault |
| Services | Graph |
Source
- Test:
tests/cisa/entra/Test.CISA.MS.AAD.8.3.ps1 - Documentation:
tests/cisa/entra/Test.CISA.MS.AAD.8.3.md