turbot/microsoft365_compliance

Control: 5.15 Ensure Guest Users are reviewed at least biweekly

Description

Guest users can be set up for those users not in your tenant to still be granted access to resources. It is important to maintain visibility for what guest users are established in the tenant.

Periodic review of guest users ensures proper access to resources in your tenant.

Remediation

To view guest users, use the Microsoft 365 Admin Center:

  1. Log in as an administrator.
  2. Navigate to the Users and Guest Users.
  3. Review the list of users.

To verify Microsoft 365 audit log search is enabled, use the Microsoft Online PowerShell Module:

  1. Run Microsoft Online PowerShell Module.
  2. Connect using Connect-MSOnline.
  3. Run the following PowerShell command:
Get-MsolUser -all | Where-Object {$_.UserType -ne "Member"} | Select-Object UserPrincipalName, UserType, CreatedDate
  1. Review the list of users.

Usage

Run the control in your terminal:

powerpipe control run microsoft365_compliance.control.cis_v140_5_15

Snapshot and share results via Turbot Pipes:

powerpipe login
powerpipe control run microsoft365_compliance.control.cis_v140_5_15 --share

SQL

This control uses a named query:

azuread_guest_user_info

Tags