EIDSCA.AP07 - Default Authorization Settings - Guest user access.
Overview
Represents role templateId for the role that should be granted to guest user.
CISA SCuBA 2.18: Guest users SHOULD have limited access to Entra ID (Azure AD) directory objects.
Test script
https://graph.microsoft.com/beta/policies/authorizationPolicy
.guestUserRoleId -eq '2af84b1e-32c8-42b7-82bc-daa82404023b'
Related links
- Open in Graph Explorer
- authorizationPolicy resource type - Microsoft Graph beta | Microsoft Learn
- View in Microsoft Entra admin center
MITRE ATT&CK
| Tactic | Technique | Mitigation |
|---|---|---|
| TA0043 - Reconnaissance - Reconnaissance |
Test Metadata
| Field | Value |
|---|---|
| Test ID | EIDSCA.AP07 |
| Severity | Medium |
| Suite | Entra ID SCA |
| Product | Entra ID |
| Feature | External identities |
| Area | External access and sharing |
| Resource type | Tenant |
| User impact | Low |
| Implementation cost | Low |
| MITRE ATT&CK | T1087.004 Cloud Account, T1069.003 Cloud Groups |
| Supports controls | nist-800-53-r5:AC-6 |
| PowerShell test | Test-MtCheckEidscaAP07 |
| Services | Graph |
Source
- Test:
tests/eidsca/Test.EIDSCA.AP07.ps1 - Documentation:
tests/eidsca/Test.EIDSCA.AP07.md