ARGUS

1.0.0-preview1

Checks/EntraID/ARG.ENT.003.ps1

Register-ArgusCheck @{
    Id          = 'ARG.ENT.003'
    Title       = 'Guest invitations are restricted'
    Area        = 'EntraID'
    Category    = 'External identities'
    Severity    = 'Medium'
    Description = 'Reads who can invite guests (`authorizationPolicy.allowInvitesFrom`): **none** or **adminsAndGuestInviters** pass; **adminsGuestInvitersAndAllMembers** (all members can invite) needs review; **everyone** (guests can invite other guests too) fails.'
    Rationale   = 'Who can bring external people into the tenant is a governance decision. Letting guests invite other guests removes the organisation from that decision.'
    Remediation = @{
        Steps      = "1. In the Microsoft Entra admin center, go to External Identities > External collaboration settings.`n2. Under Guest invite settings, choose 'Only users assigned to specific admin roles can invite guest users', or at least prevent guests from inviting.`n3. Give the Guest Inviter role to the people who need to invite partners."
        PowerShell = "# Sample only - review before running.`nConnect-MgGraph -Scopes 'Policy.ReadWrite.Authorization'`nUpdate-MgPolicyAuthorizationPolicy -AllowInvitesFrom 'adminsAndGuestInviters'"
        PortalUrl  = 'https://entra.microsoft.com/'
    }
    References  = @(
        @{ Title = 'Configure external collaboration settings'; Url = 'https://learn.microsoft.com/en-us/entra/external-id/external-collaboration-settings-configure' }
    )
    Requires    = @{
        Services    = @('Graph')
        GraphScopes = @('Policy.Read.All')
        DataSets    = @('AuthorizationPolicy')
    }
    Tags        = @('Guests', 'Policy')
    Test        = {
        param($Context)
        $value = [string](Get-ArgusProperty $Context.Data['AuthorizationPolicy'] 'allowInvitesFrom' '')
        switch ($value) {
            'none' { New-ArgusResult -Status Passed -Summary 'Nobody can invite guests (allowInvitesFrom = none).' }
            'adminsAndGuestInviters' { New-ArgusResult -Status Passed -Summary 'Only admins and users with the Guest Inviter role can invite guests.' }
            'adminsGuestInvitersAndAllMembers' { New-ArgusResult -Status Investigate -Summary 'All member users can invite guests (allowInvitesFrom = adminsGuestInvitersAndAllMembers). Acceptable in some organisations: confirm it is intended.' }
            'everyone' { New-ArgusResult -Status Failed -Summary 'Everyone, including guests, can invite guests (allowInvitesFrom = everyone).' }
            default { New-ArgusResult -Status Investigate -Summary "Guest invitation setting could not be interpreted (allowInvitesFrom = '$value')." }
        }
    }
}