Back to Checks
m365

Guest invitations are restricted to an allow-list of domains

entra_policy_guest_invitations_restricted_to_allowed_domains
Service: entraSeverity: medium
OfficialBuilt-inVerified
Categories:identity-accesstrust-boundariese3
Resource Type:NotDefined

The external collaboration settings should allow invitations only to specified domains (most restrictive). An explicit allow-list limits B2B guest invitations to trusted partner organizations, while an empty allow-list blocks invitations from all external domains.

Prowler logoProwlerprowler-provider-m365

Risk

Allowing invitations to any domain lets users invite guests from arbitrary or malicious organizations, increasing the risk of data exposure to untrusted external parties and expanding the tenant's collaboration attack surface.

Run this check with Prowler

Run in Prowler Cloud
Run
prowler m365 --checks entra_policy_guest_invitations_restricted_to_allowed_domains

Recommendation

Restrict guest invitations to an allow-list of trusted partner domains, or use an empty allow-list to block all external invitations.

Remediation

Other

1Navigate to the Microsoft Entra admin center at https://entra.microsoft.com/
2Go to **Entra ID** > **External Identities** > **External collaboration settings**
3Under **Collaboration restrictions**, select **Allow invitations only to the specified domains (most restrictive)**
4Add trusted partner domains under **Target domains**, or leave the list empty to block all external invitations
5Click **Save**

Check Code

from typing import List

from prowler.lib.check.models import Check, CheckReportM365
from prowler.providers.m365.services.entra.entra_client import entra_client


class entra_policy_guest_invitations_restricted_to_allowed_domains(Check):
    """Check if guest invitations are restricted by an allowed-domain policy.

    The B2B collaboration policy should allow invitations only to a specified list of
    domains (most restrictive). An empty allow-list blocks invitations from every
    external domain and is compliant.

    - PASS: Invitations are restricted to an allow-list, including an empty block-all
      list.
    - FAIL: Invitations are not restricted to an allow-list of domains.
    """

    def execute(self) -> List[CheckReportM365]:
        """Evaluate whether guest invitations are restricted to allowed domains.

        Inspects the B2B collaboration policy to determine whether guest invitations
        are limited to an allow-list of domains. An empty allow-list blocks all external
        invitations.

        Returns:
            List[CheckReportM365]: A single report indicating whether guest
            invitations are restricted by an allowed-domain policy, or an empty list
            when the policy is absent.
        """
        findings = []
        policy = entra_client.b2b_collaboration_policy
        if not policy:
            return findings

        report = CheckReportM365(
            metadata=self.metadata(),
            resource=policy,
            resource_name="B2B Collaboration Policy",
            resource_id="b2bManagementPolicy",
        )
        report.status = "FAIL"
        report.status_extended = (
            "Guest invitations are not restricted to an allow-list of domains."
        )

        if policy.invitations_restricted_to_allowed_domains:
            report.status = "PASS"
            if policy.allowed_domains:
                report.status_extended = (
                    "Guest invitations are restricted to an allow-list of "
                    f"{len(policy.allowed_domains)} domain(s)."
                )
            else:
                report.status_extended = (
                    "Guest invitations are blocked for all external domains."
                )

        findings.append(report)
        return findings

References