Back to Checks
m365

Authorization policy restricts guest user access to properties and memberships of their own directory objects

entra_policy_guest_users_access_restrictions
Service: entraSeverity: medium
OfficialBuilt-inVerified
Categories:identity-accesse3
Resource Type:NotDefined

Microsoft Entra authorization policy evaluates guest user access restrictions being set to the most restrictive level, where guests can view only their own directory object and related memberships (Guest user access is restricted to properties and memberships of their own directory objects).

Prowler logoProwlerprowler-provider-m365

Risk

Without this restriction, guests can read broader directory metadata and group memberships, enabling reconnaissance that harms confidentiality. A compromised guest gains context for phishing and privilege escalation, risking unauthorized changes (integrity) and disruption of collaboration spaces (availability).

Run this check with Prowler

Run in Prowler Cloud
Run
prowler m365 --checks entra_policy_guest_users_access_restrictions

Recommendation

Set guest access to the most restrictive level (Guest user access is restricted...) to enforce least privilege.

  • Avoid assigning admin roles to guests
  • Use time-bound access with approvals
  • Apply Conditional Access and limit group visibility
  • Run periodic access reviews for defense in depth

Remediation

CLI

Update-MgPolicyAuthorizationPolicy -GuestUserRoleId '2af84b1e-32c8-42b7-82bc-daa82404023b'

Terraform

resource "azuread_authorization_policy" "<example_resource_name>" {
  guest_user_role_id = "2af84b1e-32c8-42b7-82bc-daa82404023b" # Critical: sets guests to the most restrictive role (own objects only)
}

Other

1Sign in to Microsoft Entra admin center (https://entra.microsoft.com)
2Go to Identity > External Identities > External collaboration settings
3Under Guest user access, select: "Guest user access is restricted to properties and memberships of their own directory objects"
4Click Save

Check Code

from typing import List

from prowler.lib.check.models import Check, CheckReportM365
from prowler.providers.m365.services.entra.entra_client import entra_client
from prowler.providers.m365.services.entra.entra_service import AuthPolicyRoles


class entra_policy_guest_users_access_restrictions(Check):
    """Check if guest user access is restricted to their own directory objects.

    This check verifies whether the authorization policy is configured so that guest users
    are limited to accessing only the properties and memberships of their own directory objects.
    """

    def execute(self) -> List[CheckReportM365]:
        """
        Execute the guest user access restriction check.

        This method retrieves the authorization policy from the M365 Entra client,
        and then checks if the 'guest_user_role_id' matches the predefined restricted role ID.
        If it matches, the check passes; otherwise, it fails.

        Returns:
            List[CheckReportM365]: A list containing a single check report detailing
            the status and details of the guest user access restriction.
        """
        findings = []
        auth_policy = entra_client.authorization_policy

        report = CheckReportM365(
            metadata=self.metadata(),
            resource=auth_policy if auth_policy else {},
            resource_name=auth_policy.name if auth_policy else "Authorization Policy",
            resource_id=auth_policy.id if auth_policy else "authorizationPolicy",
        )
        report.status = "FAIL"
        report.status_extended = "Guest user access is not restricted to properties and memberships of their own directory objects"

        if (
            getattr(auth_policy, "guest_user_role_id", None)
            == AuthPolicyRoles.GUEST_USER_ACCESS_RESTRICTED.value
        ) or (
            getattr(auth_policy, "guest_user_role_id", None)
            == AuthPolicyRoles.GUEST_USER.value
        ):
            report.status = "PASS"
            report.status_extended = "Guest user access is restricted to properties and memberships of their own directory objects"

        findings.append(report)
        return findings

References