Back to Checks
m365

Tenant guest invitations are restricted to specific admin roles or disabled

entra_policy_guest_invite_only_for_admin_roles
Service: entraSeverity: high
OfficialBuilt-inVerified
Categories:identity-accesse3
Resource Type:NotDefined

Microsoft Entra authorization policy controls guest invitations via guest_invite_settings. It should be adminsAndGuestInviters or none, so only specific administrative roles can invite guests-or invitations are disabled.

Prowler logoProwlerprowler-provider-m365

Risk

Unrestricted invites allow broad creation of external identities. A compromised user can onboard attacker-controlled guests, gaining ongoing access to teams, sites, and apps. This erodes confidentiality, enables privilege abuse, and complicates revocation and audit.

Run this check with Prowler

Run in Prowler Cloud
Run
prowler m365 --checks entra_policy_guest_invite_only_for_admin_roles

Recommendation

Apply least privilege: restrict invites to the Guest Inviter or designated admin roles (adminsAndGuestInviters), or disable invites (none).

  • Require approval and justification
  • Allowlist partner domains and use access reviews
  • Combine with Conditional Access and cross-tenant policies for defense in depth

Remediation

CLI

Update-MgPolicyAuthorizationPolicy -AuthorizationPolicyId authorizationPolicy -AllowInvitesFrom adminsAndGuestInviters

Other

1Sign in to the Microsoft Entra admin center (https://entra.microsoft.com)
2Go to Entra ID > External Identities > External collaboration settings
3Under Guest invite settings, select "Only users assigned to specific admin roles can invite guest users" (or select "No one in the organization can invite guest users" to disable)
4Click Save

Check Code

from typing import List

from prowler.lib.check.models import Check, CheckReportM365
from prowler.providers.m365.services.entra.entra_client import entra_client
from prowler.providers.m365.services.entra.entra_service import InvitationsFrom


class entra_policy_guest_invite_only_for_admin_roles(Check):
    """Check if guest invitations are restricted to users with specific administrative roles.

    This check verifies the `guest_invite_settings` property of the authorization policy.
    If the setting is set to either "adminsAndGuestInviters" or "none", guest invitations
    are limited accordingly. Otherwise, they are not restricted.
    """

    def execute(self) -> List[CheckReportM365]:
        """
        Execute the guest invitation restriction check.

        Retrieves the authorization policy from the Microsoft Entra client and checks
        whether the 'guest_invite_settings' is set to restrict invitations to users with
        specific administrative roles only.

        Returns:
            List[CheckReportM365]: A list containing a single check report that
            details the pass/fail status and description.
        """
        findings = []
        auth_policy = entra_client.authorization_policy

        report = CheckReportM365(
            metadata=self.metadata(),
            resource=auth_policy if auth_policy else {},
            resource_name=auth_policy.name if auth_policy else "Authorization Policy",
            resource_id=auth_policy.id if auth_policy else "authorizationPolicy",
        )
        report.status = "FAIL"
        report.status_extended = "Guest invitations are not restricted to users with specific administrative roles only."

        if (
            getattr(auth_policy, "guest_invite_settings", None)
            == InvitationsFrom.ADMINS_AND_GUEST_INVITERS.value
        ) or (
            getattr(auth_policy, "guest_invite_settings", None)
            == InvitationsFrom.NONE.value
        ):
            report.status = "PASS"
            report.status_extended = "Guest invitations are restricted to users with specific administrative roles only."

        findings.append(report)
        return findings

References