Rules/ID-006.guest-access-restricted.psd1
|
@{ Id = 'ID-006' Title = 'Guest users have restricted directory permissions' Area = 'AuthorizationPolicy' Severity = 'Medium' References = @( 'CIS Microsoft 365 Foundations Benchmark (guest user access)' 'https://learn.microsoft.com/entra/fundamentals/users-default-permissions#member-and-guest-users' ) Rationale = 'Guests with member-level permissions can enumerate the entire directory - users, groups, apps - which external accounts have no business seeing.' Remediation = 'Set guest user access to "Guest users have limited access" or "Guest user access is restricted" in External collaboration settings.' Test = { param($Snapshot) $authPolicy = $Snapshot.AuthorizationPolicy.authorizationPolicy if (-not $authPolicy -or -not $authPolicy.PSObject.Properties['guestUserRoleId'] -or -not $authPolicy.guestUserRoleId) { return New-TLRuleResult -Status Manual -Evidence 'guestUserRoleId not present in the snapshot.' } $roleId = [string]$authPolicy.guestUserRoleId $labels = @{ 'a0b1b346-4d3e-4e8b-98f8-753987be4970' = 'same as member users' '10dae51f-b6af-4016-8d66-8c2a99b929b3' = 'limited access (default)' '2af84b1e-32c8-42b7-82bc-daa82404023b' = 'restricted access' } $label = $(if ($labels.ContainsKey($roleId)) { $labels[$roleId] } else { $roleId }) if ($roleId -eq 'a0b1b346-4d3e-4e8b-98f8-753987be4970') { New-TLRuleResult -Status Fail -Evidence ("Guest permissions: {0}." -f $label) } else { New-TLRuleResult -Status Pass -Evidence ("Guest permissions: {0}." -f $label) } } } |