Azure Compliance ControlsMicrosoft Entra ID
Guest users should have access reviews configured monthly
Guest users allow you to share your company's applications and services with users from any other organization, while maintaining control over your own corporate data. Guest users should be review on a monthly basis to remove inactive and unneeded accounts.
What this control checks
The powerpipe check ad_guest_user_reviewed_monthly, titled "Ensure guest users are reviewed on a monthly basis", runs the query ad_guest_user_reviewed_monthly under the Azure/ActiveDirectory service tag.
Framework mappings
The clauses this control is mapped to in each framework.
- 6.3.2 Ensure that guest users are reviewed on a regular basis
- 5.3.2 Ensure that guest users are reviewed on a regular basis
- 1.3 Ensure guest users are reviewed on a monthly basis
- 1.3 Ensure guest users are reviewed on a monthly basis
- 1.4 Ensure Guest Users Are Reviewed on a Regular Basis
- 1.5 Ensure Guest Users Are Reviewed on a Regular Basis
- 1.4 Ensure Guest Users Are Reviewed on a Regular Basis
- 2.4 Ensure Guest Users Are Reviewed on a Regular Basis
Related controls
- Microsoft Entra ID policies should have 'Guest invite restrictions' set to 'Only users assigned to specific admin roles [...]' or 'No one [..]'
- Azure subscriptions should not have guest accounts with write permissions
- Microsoft Entra ID policies should have 'User consent for applications' set to 'Do not allow user consent'
Tool mappings
Use these identifiers to cross-reference this control across tools, reports, and evidence.
- Compliance.tf Control:
ad_guest_user_reviewed_monthly - Powerpipe Control:
azure_compliance.control.ad_guest_user_reviewed_monthly
Last reviewed: 2026-10-09