EIDSCA.ST08 - Default Settings - Classification and M365 Groups - M365 groups - Allow Guests to become Group Owner.

Contributed by Thomas NaunheimAll contributors →

Overview

Indicating whether or not a guest user can be an owner of groups, manage

CISA SCuBA 2.18: Guest users SHOULD have limited access to Entra ID (Azure AD) directory objects

Test script

https://graph.microsoft.com/beta/settings
.values -eq 'false'

Remediation action

Microsoft Learn - Microsoft Entra cmdlets for configuring group settings

Related links

• Open in Graph Explorer
• directorySetting resource type - Microsoft Graph beta | Microsoft Learn

Test Metadata

Field	Value
Test ID	EIDSCA.ST08
Severity	Medium
Suite	Entra ID SCA
Product	Entra ID
Feature	Groups
Area	External access and sharing
Resource type	Tenant
User impact	Low
Implementation cost	Low
MITRE ATT&CK	T1098 Account Manipulation
Supports controls	nist-800-53-r5:AC-6
PowerShell test	Test-MtCheckEidscaST08
Services	Graph

Source

• Test: tests/eidsca/Test.EIDSCA.ST08.ps1
• Documentation: tests/eidsca/Test.EIDSCA.ST08.md