Back to Checks
azure

Authorization policy restricts guest user access to properties and memberships of their own directory objects

entra_policy_guest_users_access_restrictions
Service: entraSeverity: medium
OfficialBuilt-inVerified
Categories:identity-accesse3
Resource Type:NotDefined

Microsoft Entra authorization policy guest settings are assessed to determine whether guest user access is limited to the properties and memberships of their own directory objects (Restricted access) instead of broader visibility into users and groups

Prowler logoProwlerprowler-provider-azure

Risk

Excess guest visibility enables directory reconnaissance, exposing user and group details for phishing, password spraying, and targeted attacks. This weakens confidentiality and can facilitate privilege escalation and lateral movement through informed abuse of group memberships and access paths.

Run this check with Prowler

Run in Prowler Cloud
Run
prowler azure --checks entra_policy_guest_users_access_restrictions

Recommendation

Apply least privilege to external users:

  • Set guest access to Restricted access so guests can only view their own directory objects
  • Avoid assigning admin roles to guests; use PIM for rare exceptions
  • Constrain external collaboration and group visibility, and run periodic access reviews to remove stale guest access

Remediation

CLI

az rest --method patch --url https://graph.microsoft.com/v1.0/policies/authorizationPolicy/authorizationPolicy --body '{"guestUserRoleId":"2af84b1e-32c8-42b7-82bc-daa82404023b"}'

Terraform

resource "azuread_authorization_policy" "<example_resource_name>" {
  # Critical: sets guests to 'Restricted access' so they can only access their own directory object
  guest_user_role_id = "2af84b1e-32c8-42b7-82bc-daa82404023b"
}

Other

1Go to Microsoft Entra admin center > External Identities > External collaboration settings
2Select "Guest user access is restricted to properties and memberships of their own directory objects"
3Click Save
4Allow up to 15 minutes for the change to take effect

Check Code

from prowler.lib.check.models import Check, Check_Report_Azure
from prowler.providers.azure.config import GUEST_USER_ACCESS_RESTRICTICTED
from prowler.providers.azure.services.entra.entra_client import entra_client


class entra_policy_guest_users_access_restrictions(Check):
    def execute(self) -> Check_Report_Azure:
        findings = []

        for tenant_domain, auth_policy in entra_client.authorization_policy.items():
            report = Check_Report_Azure(metadata=self.metadata(), resource=auth_policy)
            report.subscription = f"Tenant: {tenant_domain}"
            report.resource_name = getattr(auth_policy, "name", "Authorization Policy")
            report.resource_id = auth_policy.id
            report.status = "FAIL"
            report.status_extended = "Guest user access is not restricted to properties and memberships of their own directory objects"

            if (
                getattr(auth_policy, "guest_user_role_id", None)
                == GUEST_USER_ACCESS_RESTRICTICTED
            ):
                report.status = "PASS"
                report.status_extended = "Guest user access is restricted to properties and memberships of their own directory objects"

            findings.append(report)

        return findings

References