Guest users should have access reviews configured monthly
Guest users allow you to share your company's applications and services with users from any other organization, while maintaining control over your own corporate data. Guest users should be review on a monthly basis to remove inactive and unneeded accounts.
Guest users allow you to share your company's applications and services with users from any other organization, while maintaining control over your own corporate data. Guest users should be review on a monthly basis to ensure that inactive and unneeded accounts are removed.
What this control checks
Guest users are reviewed on a monthly basis to remove inactive and unneeded accounts.
Audit evidence
Evidence that deployed resources meet this control: PowerPipe control azure_compliance.control.ad_guest_user_reviewed_monthly.
Framework-specific interpretation
CIS Azure Benchmark v4.0.0: Mapped to 6.3.2 (Ensure that guest users are reviewed on a regular basis).
CIS Azure Benchmark v5.0.0: Mapped to 5.3.2 (Ensure that guest users are reviewed on a regular basis).
CIS Azure Benchmark v1.3.0: Mapped to 1.3 (Ensure guest users are reviewed on a monthly basis).
CIS Azure Benchmark v1.4.0: Mapped to 1.3 (Ensure guest users are reviewed on a monthly basis).
CIS Azure Benchmark v1.5.0: Mapped to 1.4 (Ensure Guest Users Are Reviewed on a Regular Basis).
CIS Azure Benchmark v2.0.0: Mapped to 1.5 (Ensure Guest Users Are Reviewed on a Regular Basis).
CIS Azure Benchmark v2.1.0: Mapped to 1.4 (Ensure Guest Users Are Reviewed on a Regular Basis).
CIS Azure Benchmark v3.0.0: Mapped to 2.4 (Ensure Guest Users Are Reviewed on a Regular Basis).
Framework mappings
The clauses this control is mapped to in each framework.
- 6.3.2 Ensure that guest users are reviewed on a regular basis
- 5.3.2 Ensure that guest users are reviewed on a regular basis
- 1.3 Ensure guest users are reviewed on a monthly basis
- 1.3 Ensure guest users are reviewed on a monthly basis
- 1.4 Ensure Guest Users Are Reviewed on a Regular Basis
- 1.5 Ensure Guest Users Are Reviewed on a Regular Basis
- 1.4 Ensure Guest Users Are Reviewed on a Regular Basis
- 2.4 Ensure Guest Users Are Reviewed on a Regular Basis
Related controls
- Microsoft Entra ID policies should have 'Guest invite restrictions' set to 'Only users assigned to specific admin roles [...]' or 'No one [..]'
- Azure subscriptions should not have guest accounts with write permissions
- Microsoft Entra ID policies should have 'User consent for applications' set to 'Do not allow user consent'
Tool mappings
Use these identifiers to cross-reference this control across tools, reports, and evidence.
- Compliance.tf Control:
ad_guest_user_reviewed_monthly - Powerpipe Control:
azure_compliance.control.ad_guest_user_reviewed_monthly
Last reviewed: 2026-10-09