Pipeline: 2.16 Ensure that 'Guest invite restrictions' is set to 'Only users assigned to specific admin roles can invite guest users'

Description

Restrict invitations to users with specific administrative roles only.

Restricting invitations to users with specific administrator roles ensures that only authorized accounts have access to cloud resources. This helps to maintain "Need to Know" permissions and prevents inadvertent access to data.

By default the setting Guest invite restrictions is set to Anyone in the organization can invite guest users including guests and non-admins. This would allow anyone within the organization to invite guests and non-admins to the tenant, posing a security risk.

Remediation

From Azure Portal

From Azure Home select the Portal Menu.
Select Microsoft Entra ID.
Under Manage, select External Identities.
Select External collaboration settings.
Under Guest invite settings, set Guest invite restrictions, to Only users assigned to specific admin roles can invite guest users.
Click Save.

From Powershell

Enter the following:

Connect-MgGraph
Update-MgPolicyAuthorizationPolicy -AllowInvitesFrom "adminsAndGuestInviters"

Default Value

By default, Guest invite restrictions is set to Anyone in the organization can invite guest users including guests and non-admins.

Run the pipeline

To run this pipeline from your terminal:

flowpipe pipeline run azure_cis.pipeline.cis_v300_2_16

Use this pipeline

To call this pipeline from your pipeline, use a step:

step "pipeline" "step_name" {
  pipeline = azure_cis.pipeline.cis_v300_2_16  
}

Params

Name	Type	Required	Description	Default
database	connection.steampipe	Yes	Database connection string.	`connection.steampipe.default`
notifier	notifier	Yes	The name of the notifier to use for sending notification messages.	`notifier.default`
notification_level	string	Yes	The verbosity level of notification messages to send. Valid options are 'verbose', 'info', 'error'.	`info`
approvers	list(notifier)	Yes	List of notifiers to be used for obtaining action/approval decisions.	`notifier.default`

Outputs

This pipeline has no outputs.