turbot/azure_compliance
Loading controls...

Control: 1.13 Ensure that 'Guest invite restrictions' is set to 'Only users assigned to specific admin roles can invite guest users'

Description

Restrict invitations to administrators only.

Restricting invitations to administrators ensures that only authorized accounts have access to cloud resources. This helps to maintain Need to Know permissions and prevents inadvertent access to data.

By default the setting Admins and users in the guest inviter role can invite is set to yes. This will allow you to use the inviter role to control who will be able to invite guests to the tenant.

Remediation

From Console

  1. Log in to Azure Active Directory
  2. Go to External Identities
  3. Go to External collaboration settings
  4. Restrict Guest invite restrictions to Only users assigned to specific admin roles can invite guest users

Note: By default, Members can invite is set to Yes.

Usage

Run the control in your terminal:

powerpipe control run azure_compliance.control.cis_v140_1_13

Snapshot and share results via Turbot Pipes:

powerpipe login
powerpipe control run azure_compliance.control.cis_v140_1_13 --share

SQL

This control uses a named query:

ad_manual_control

Tags