EIDSCA.AP14 - Default Authorization Settings - Default User Role Permissions - Allowed to read other users.
Overview
Prevents all non-admins from reading user information from the directory. This flag doesn't prevent reading user information in other Microsoft services like Exchange Online.
Restrict this default permissions for members have huge impact on collaboration features and user lookup.
Test script
https://graph.microsoft.com/beta/policies/authorizationPolicy
.defaultUserRolePermissions.allowedToReadOtherUsers -eq 'true'
Remediation action
Microsoft Graph PowerShell: PolicyAuthorizationPolicy -BodyParameter @{DefaultUserRolePermissions = @{AllowedToReadOtherUsers = $false}}
Related links
MITRE ATT&CK
| Tactic | Technique | Mitigation |
|---|---|---|
| TA0043 - Reconnaissance - Reconnaissance |
Test Metadata
| Field | Value |
|---|---|
| Test ID | EIDSCA.AP14 |
| Severity | Info |
| Suite | Entra ID SCA |
| Product | Entra ID |
| Feature | User and directory settings |
| Area | Access control |
| Resource type | Tenant |
| MITRE ATT&CK | None |
| Supports controls | nist-800-53-r5:AC-3 |
| PowerShell test | Test-MtCheckEidscaAP14 |
| Services | Graph |
Source
- Test:
tests/eidsca/Test.EIDSCA.AP14.ps1 - Documentation:
tests/eidsca/Test.EIDSCA.AP14.md