lacework-global-509
1.15 Ensure That 'Guest users access restrictions' is set to 'Guest user access is restricted to properties and memberships of their own directory objects' (Manual)
Profile Applicability
• Level 1
Description
Limit guest user permissions.
Rationale
Limiting guest access ensures that guest accounts do not have permission for certain directory tasks, such as enumerating users, groups or other directory resources, and cannot be assigned to administrative roles in your directory. Guest access has three levels of restriction.
- Guest users have the same access as members (most inclusive),
- Guest users have limited access to properties and memberships of directory objects (default value),
- Guest user access is restricted to properties and memberships of their own directory objects (most restrictive).
The recommended option is the 3rd, most restrictive: "Guest user access is restricted to their own directory object".
Impact
This may create additional requests for permissions to access resources that administrators will need to approve.
Audit
From Azure Portal
- From Azure Home select the Portal Menu
- Select
Azure Active Directory
- Then
External Identities
- Select
External collaboration settings
- Under
Guest user access
, ensure thatGuest user access restrictions
is set toGuest user access is restricted to properties and memberships of their own directory objects
From Azure Powershell
- Enter the following
Get-AzureADMSAuthorizationPolicy
Which will give a result like:
Id : authorizationPolicy
OdataType :
Description : Used to manage authorization related settings across the company.
DisplayName : Authorization Policy
EnabledPreviewFeatures : {}
GuestUserRoleId : 10dae51f-b6af-4016-8d66-8c2a99b929b3
PermissionGrantPolicyIdsAssignedToDefaultUserRole : {user-default-legacy}
If the GuestUserRoleID property does not equal 2af84b1e-32c8-42b7-82bc-daa82404023b
then it is not set to most restrictive.
Remediation
From Azure Portal
- From Azure Home select the Portal Menu
- Select
Azure Active Directory
- Then
External Identities
- Select
External collaboration settings
- Under
Guest user access
, changeGuest user access restrictions
to beGuest user access is restricted to properties and memberships of their own directory objects
From Azure Powershell
- From a Powershell session enter
Set-AzureADMSAuthorizationPolicy -GuestUserRoleId '2af84b1e-32c8-42b7-82bc-daa82404023b'
- Check that the setting was applied by entering
Get-AzureADMSAuthorizationPolicy
- Make certain that the GuestUserRoleId is equal to the earlier entered value of 2af84b1e-32c8-42b7-82bc-daa82404023b.
References
https://docs.microsoft.com/en-us/azure/active-directory/fundamentals/users-default-permissions#member-and-guest-users
https://docs.microsoft.com/en-us/security/benchmark/azure/security-controls-v3-privileged-access#pa-5-automate-entitlement-management
https://docs.microsoft.com/en-us/security/benchmark/azure/security-controls-v3-governance-strategy#gs-2-define-enterprise-segmentation-strategy
https://docs.microsoft.com/en-us/security/benchmark/azure/security-controls-v3-governance-strategy#gs-6-define-identity-and-privileged-access-strategy
https://docs.microsoft.com/en-us/azure/active-directory/enterprise-users/users-restrict-guest-permissions