Detections
Analytics

1.4 Ensure Access Review is Set Up for External Users in Azure AD Privileged Identity Management

Warning! Audit Deprecated

This audit has been deprecated and will be removed in a future update.

View Next Audit Version

Information

This recommendation extends guest access review by utilizing the Azure AD Privileged Identity Management feature provided in Azure AD Premium P2.

Azure AD is extended to include Azure AD B2B collaboration, allowing you to invite people from outside your organization to be guest users in your cloud account and sign in with their own work, school, or social identities. Guest users allow you to share your company's applications and services with users from any other organization, while maintaining control over your own corporate data.

Work with external partners, large or small, even if they don't have Azure AD or an IT department. A simple invitation and redemption process lets partners use their own credentials to access your company's resources a a guest user.

Rationale:

Guest users in the Azure AD are generally required for collaboration purposes in Office 365, and may also be required for Azure functions in enterprises with multiple Azure tenants. Guest users should be reviewed on a regular basis, at least annually. Guest users should not be granted administrative roles where possible.

Guest users are typically added outside your employee on-boarding/off-boarding process and could potentially be overlooked indefinitely, leading to a potential vulnerability.

Guest users should be reviewed on a monthly basis to ensure that inactive and unneeded accounts are removed.

Impact:

Until you have a business need to provide guest access to any user, avoid creating guest users. If guest accounts are being used, they should be removed when no longer required.

NOTE: Nessus has not performed this check. Please review the benchmark to ensure target compliance.

Solution

From Azure Portal

From the Azure Portal home page click the portal menu in the top left.

Select Azure Active Directory

Select Users in the left column under the Manage heading.

Next to the search box select the filter option.

Search for and select User Type

In the third drop down Value select Guest.

Review the guest users in your Active Directory.

For those you wish to delete, select the checkbox on the left then the Delete option in the top row.

From Azure CLI
With the information from the audit procedure, to remove a Guest user run the following command with their User Principal Value.

Remove-AzureADUser -ObjectId '<[email protected]'

From PowerShell
With the information from the audit procedure, to remove a Guest user run the following command with their User Principal Value.

Remove-AzureADUser -ObjectId '<[email protected]>'

Default Value:

By default no guest users are created.

See Also

https://workbench.cisecurity.org/benchmarks/10624

Item Details

References: CSCv7|16.6, CSCv7|16.8

Plugin: microsoft_azure

Control ID: 47bb6c3647a088277891f27e9f5764fbdcb9d8352041de6a64b646732823b984