Azure Compliance ControlsMicrosoft Entra ID
Microsoft Entra ID policies should have 'Guest invite restrictions' set to 'Only users assigned to specific admin roles [...]' or 'No one [..]'
Restricts guest invitations in the Microsoft Entra authorization policy. Guest invite settings should be adminsAndGuestInviters or none. Only specific administrative roles can invite guests, or invitations are disabled.
What this control checks
Guest invitations are limited to users in specific admin roles, or turned off for everyone
Framework mappings
The clauses this control is mapped to in each framework.
- A.5.15 Access control
- A.5.18 Access rights
- A.8.2 Privileged access rights
- 2 Risk management policy
- 3 Incident handling
- 6 Security in network and information systems acquisition, development and maintenance
- 11 Access control
- 6.16 Ensure that 'Guest invite restrictions' is set to 'Only users assigned to specific admin roles can invite guest users'
- 5.16 Ensure that 'Guest invite restrictions' is set to 'Only users assigned to specific admin roles [...]' or 'No one [..]'
RBI Cyber Security Framework for UCBs
- Annex I (7.1)
- IAM-01.01B The cloud service provider documents, communicates and makes available according to SP-01: - A role, rights and authorities concept based on role-based access control and the business and security requirements of the cloud service provider; and- A policy for managing user accounts and...
- IAM-04.06B If the cloud service provider defines break glass accounts to be used when the main procedure for authentication is not available, then the cloud service provider defines and enforces specific requirements and procedures for secure usage of those accounts.
- IAM-06.01B Privileged access rights for internal and external employees as well as technical users of the cloud service provider are assigned and changed in accordance with the policy for managing user accounts and access rights (cf. IAM-01) or a separate specific policy.
- IAM-06.02B Privileged access rights are personalised, limited in time according to a risk assessment and assigned as necessary for the execution of tasks ('need-to-know principle').
- OIS-02.01B Top management of the cloud service provider has adopted an information security policy.
2 more clauses
- OIS-04.01AC The cloud service provider monitors and enforces measures related to segregation of duties to resolve conflicting roles.
- PSS-09.01AC Access controls are attribute-based to enable granular and contextual checks against multiple attributes of a user, IT component, or application (e.g., role, location, authentication method).
- 1.16 Ensure that 'Guest invite restrictions' is set to 'Only users assigned to specific admin roles can invite guest users'
- 1.15 Ensure that 'Guest invite restrictions' is set to Only users assigned to specific admin roles can invite guest users
- 2.16 Ensure that 'Guest invite restrictions' is set to 'Only users assigned to specific admin roles can invite guest users'
Related controls
Tool mappings
Use these identifiers to cross-reference this control across tools, reports, and evidence.
- Compliance.tf Control:
ad_authorization_policy_guest_invite_restricted - Powerpipe Control:
azure_compliance.control.ad_authorization_policy_guest_invite_restricted - Prowler Check:
entra_policy_guest_invite_only_for_admin_roles
Last reviewed: 2026-10-09