EIDSCA.AP04 - Default Authorization Settings - Guest invite restrictions.
Overview
Manages controls who can invite guests to your directory to collaborate on resources secured by your Entra ID (Azure AD), such as SharePoint sites or Azure resources.
CISA SCuBA 2.18: Only users with the Guest Inviter role SHOULD be able to invite guest users
Test script
https://graph.microsoft.com/beta/policies/authorizationPolicy
.allowInvitesFrom -in @('adminsAndGuestInviters','none')
Related links
- Open in Graph Explorer
- authorizationPolicy resource type - Microsoft Graph beta | Microsoft Learn
- View in Microsoft Entra admin center
MITRE ATT&CK
| Tactic | Technique | Mitigation |
|---|---|---|
| TA0003 - Persistence - Persistence |
Test Metadata
| Field | Value |
|---|---|
| Test ID | EIDSCA.AP04 |
| Severity | Medium |
| Suite | Entra ID SCA |
| Product | Entra ID |
| Feature | External identities |
| Area | External access and sharing |
| Resource type | Tenant |
| User impact | Medium |
| Implementation cost | Low |
| MITRE ATT&CK | T1136.003 Cloud Account |
| Supports controls | nist-800-53-r5:AC-6(10) |
| PowerShell test | Test-MtCheckEidscaAP04 |
| Services | Graph |
Source
- Test:
tests/eidsca/Test.EIDSCA.AP04.ps1 - Documentation:
tests/eidsca/Test.EIDSCA.AP04.md