Skip to content
MitoMito Docs

CISA.MS.AAD.8.3: Guest invites SHOULD only be allowed to specific external domains that have been authorized by the agency for legitimate business purposes.
ID CISA.MS.AAD.8.3
Severity Medium
Suite CISA SCuBA baselines
Product Entra ID
Feature External identities
Security area External access and sharing
Resource type Tenant
User impact of fixing Medium
Effort to fix Medium
Benchmark CISA SCuBA Secure Configuration Baselines for Microsoft 365 ScubaGear main, 2026-10-11, MS.AAD.8.3 (SHOULD)
Framework controls cisa-scuba:MS.AAD.8.3
nist-800-53-r5:AC-3 Access Enforcement
MITRE ATT&CK T1078.004
Reads from Microsoft Graph

What this checks and how to fix it

Section titled “What this checks and how to fix it”

Guest invites SHOULD only be allowed to specific external domains that have been authorized by the agency for legitimate business purposes.

Rationale: Limiting which domains can be invited to create guest accounts in the tenant helps reduce the risk of users from unauthorized external organizations getting access.

⚠️ WARNING: This test utilizes a technical mechanism that differs from CISA’s, though the outcome is the same.

Remediation action:

Section titled “Remediation action:”
  1. In Entra admin center select External Identities and Cross-tenant access settings.
  2. Under Default settings, select Edit inbound defaults.
  3. Under B2B collaboration, and External users and groups, ensure Access status is set to Block access.
  4. Under B2B collaboration, and Applications, ensure Access status is set to Block access.

This configuration will only allow B2B collaboration with other Entra tenants.

Section titled “Related links”

Mito check, based on CISA ScubaGear. Author: soulemike. Open-source licences.

Open-source licences. CIS Benchmark material © Center for Internet Security, Inc.; CISA SCuBA baselines are public domain (CC0).

© 2026 Virtual Petals. Mito is a Virtual Petals service, hosted in Microsoft Azure UAE North.