CISA.MS.AAD.8.2: Only users with the Guest Inviter role SHOULD be able to invite guest users.

ID	CISA.MS.AAD.8.2
Severity	Medium
Suite	CISA SCuBA baselines
Product	Entra ID
Feature	External identities
Security area	External access and sharing
Resource type	Tenant
User impact of fixing	Medium
Effort to fix	Low
Benchmark	CISA SCuBA Secure Configuration Baselines for Microsoft 365 ScubaGear main, 2026-10-11, MS.AAD.8.2 (SHOULD)
Framework controls	cisa-scuba:MS.AAD.8.2 nist-800-53-r5:AC-6(10) Least Privilege | Prohibit Non-privileged Users from Executing Privileged Functions
MITRE ATT&CK	T1098.003, T1136.003
Reads from	Microsoft Graph

What this checks and how to fix it

Only users with the Guest Inviter role SHOULD be able to invite guest users.

Rationale: By only allowing an authorized group of individuals to invite external users to create accounts in the tenant, an agency can enforce a guest user account approval process, reducing the risk of unauthorized account creation.

Remediation action:

1. In Entra ID and External Identities, select External collaboration settings.

2. Under Guest invite settings, select Only users assigned to specific admin roles can invite guest users or No one in the organization can invite guest users including admins (most restrictive).

3. Click Save.

Related links

• Entra admin center - External Identities | External collaboration settings
• CISA Guest User Access - MS.AAD.8.2v1
• CISA ScubaGear Rego Reference

---

Mito check, based on CISA ScubaGear. Author: soulemike; contributors: michaelmsonne, mattcave. Open-source licences.