Microsoft Entra ID policies should have 'Guest users access restrictions' set to 'Guest user access is restricted to properties and memberships of their own directory objects'
Checks the Microsoft Entra authorization policy for the `Guest users access restrictions` setting and reports whether it is set to the most restrictive level, which limits guests to the properties and memberships of their own directory objects.
What this control checks
Guest user access is restricted to properties and memberships of their own directory objects
Framework mappings
The clauses this control is mapped to in each framework.
- A.5.15 Access control
- A.5.16 Identity management
- A.5.18 Access rights
- A.8.3 Information access restriction
- 2 Risk management policy
- 3 Incident handling
- 11 Access control
- 6.15 Ensure that 'Guest users access restrictions' is set to 'Guest user access is restricted to properties and memberships of their own directory objects'
- 5.3.2 Ensure that guest users are reviewed on a regular basis
- 5.15 Ensure that 'Guest users access restrictions' is set to 'Guest user access is restricted to properties and memberships of their own directory objects'
RBI Cyber Security Framework for UCBs
- Annex I (7.1)
- IAM-01.01B The cloud service provider documents, communicates and makes available according to SP-01: - A role, rights and authorities concept based on role-based access control and the business and security requirements of the cloud service provider; and- A policy for managing user accounts and...
- IAM-06.01B Privileged access rights for internal and external employees as well as technical users of the cloud service provider are assigned and changed in accordance with the policy for managing user accounts and access rights (cf. IAM-01) or a separate specific policy.
- IAM-06.02B Privileged access rights are personalised, limited in time according to a risk assessment and assigned as necessary for the execution of tasks ('need-to-know principle').
- IAM-08.05B The cloud service provider documents, communicates and makes available to all users under its responsibility rules and recommendations for the management of credentials, including at least: - Non-reuse of credentials;- Trade-offs between entropy and ability to memorise;-...
- IAM-10.01B The cloud service provider ensures that access to its internal data and system functions is controlled and restricted to authorised personnel.
4 more clauses
- IAM-10.02B The cloud service provider establishes processes and technical controls to manage and verify access permissions within its internal systems.
- PS-03.02B The security measures are designed to detect and prevent unauthorised access so that the information security of the cloud service is not compromised.
- PSS-09.01AC Access controls are attribute-based to enable granular and contextual checks against multiple attributes of a user, IT component, or application (e.g., role, location, authentication method).
- SP-01.04B The policies and instructions are approved by the top management of the cloud service provider or an authorised body.
- 1.15 Ensure That 'Guest users access restrictions' is set to 'Guest user access is restricted to properties and memberships of their own directory objects'
- 1.14 Ensure That 'Guest users access restrictions' is set to 'Guest user access is restricted to properties and memberships of their own directory objects'
- 2.15 Ensure That 'Guest users access restrictions' is set to 'Guest user access is restricted to properties and memberships of their own directory objects'
Related controls
Tool mappings
Use these identifiers to cross-reference this control across tools, reports, and evidence.
- Compliance.tf Control:
ad_authorization_policy_guest_user_access_restricted - Powerpipe Control:
azure_compliance.control.ad_authorization_policy_guest_user_access_restricted - Prowler Check:
entra_policy_guest_users_access_restrictions
Last reviewed: 2026-10-09
Microsoft Entra ID policies should have 'Guest invite restrictions' set to 'Only users assigned to specific admin roles [...]' or 'No one [..]'
Previous Page
Microsoft Entra ID policies should have 'Require Multifactor Authentication to register or join devices with Microsoft Entra' set to 'Yes'
Next Page