Pipeline: 2.4 Ensure Guest Users Are Reviewed on a Regular Basis
Description
Microsoft Entra ID has native and extended identity functionality allowing you to invite people from outside your organization to be guest users in your cloud account and sign in with their own work, school, or social identities.
Guest users are typically added outside your employee on-boarding/off-boarding process and could potentially be overlooked indefinitely. To prevent this, guest users should be reviewed on a regular basis. During this audit, guest users should also be determined to not have administrative privileges.
Remediation
From Azure Portal
- From Azure Home select the Portal Menu.
- Select
Microsoft Entra ID
. - Under
Manage
, selectUsers
. - Click on
Add filter
. - Select
User type
. - Select
Guest
from the Value dropdown. - Click
Apply
. - Check the box next to all
Guest
users that are no longer required or are inactive. - Click
Delete
. - Click
OK
.
From Azure CLI
Before deleting the user, set it to inactive using the ID from the Audit Procedure to determine if there are any dependent systems.
az ad user update --id <exampleaccountid@domain.com> --account-enabled {false}
After determining that there are no dependent systems delete the user.
Remove-AzureADUser -ObjectId <exampleaccountid@domain.com>
From Azure PowerShell
Before deleting the user, set it to inactive using the ID from the Audit Procedure to determine if there are any dependent systems.
Set-AzureADUser -ObjectId "<exampleaccountid@domain.com>" -AccountEnabled false
After determining that there are no dependent systems delete the user.
PS C:\>Remove-AzureADUser -ObjectId <exampleaccountid@domain.com>
Default Value
By default no guest users are created.
Run the pipeline
To run this pipeline from your terminal:
flowpipe pipeline run azure_cis.pipeline.cis_v300_2_4
Use this pipeline
To call this pipeline from your pipeline, use a step:
step "pipeline" "step_name" { pipeline = azure_cis.pipeline.cis_v300_2_4 }
Params
Name | Type | Required | Description | Default |
---|---|---|---|---|
database | connection.steampipe | Yes | Database connection string. | connection.steampipe.default |
notifier | notifier | Yes | The name of the notifier to use for sending notification messages. | notifier.default |
notification_level | string | Yes | The verbosity level of notification messages to send. Valid options are 'verbose', 'info', 'error'. | info |
Outputs
This pipeline has no outputs.