Rules/ID-004.guest-invites-restricted.psd1
|
@{ Id = 'ID-004' Title = 'Guest invitations are restricted to admins and guest inviters' Area = 'AuthorizationPolicy' Severity = 'Medium' References = @( 'CIS Microsoft 365 Foundations Benchmark (guest invite settings)' 'https://learn.microsoft.com/entra/external-id/external-collaboration-settings-configure' ) Rationale = 'When everyone (including guests) can invite guests, external access grows uncontrolled and unauditable.' Remediation = 'Set "Who can invite" to "Only users assigned to specific admin roles" (or at most "Member users and guest inviters") in External collaboration settings.' Test = { param($Snapshot) $authPolicy = $Snapshot.AuthorizationPolicy.authorizationPolicy if (-not $authPolicy -or -not $authPolicy.PSObject.Properties['allowInvitesFrom'] -or -not $authPolicy.allowInvitesFrom) { return New-TLRuleResult -Status Manual -Evidence 'allowInvitesFrom not present in the snapshot.' } $value = [string]$authPolicy.allowInvitesFrom if (@('none', 'adminsAndGuestInviters') -contains $value) { New-TLRuleResult -Status Pass -Evidence ("allowInvitesFrom = '{0}'" -f $value) } else { New-TLRuleResult -Status Fail -Evidence ("allowInvitesFrom = '{0}' - guests can be invited too broadly." -f $value) } } } |