EIDSCA.AP07: Default Authorization Settings - Guest user access.

ID	EIDSCA.AP07
Severity	Medium
Suite	EIDSCA
Product	Entra ID
Feature	External identities
Security area	External access and sharing
Resource type	Tenant
User impact of fixing	Low
Effort to fix	Low
Framework controls	nist-800-53-r5:AC-6 Least Privilege
MITRE ATT&CK	T1087.004, T1069.003
Reads from	Microsoft Graph

What this checks and how to fix it

Represents role templateId for the role that should be granted to guest user.

CISA SCuBA 2.18: Guest users SHOULD have limited access to Entra ID (Azure AD) directory objects.

Test script

https://graph.microsoft.com/beta/policies/authorizationPolicy
.guestUserRoleId -eq '2af84b1e-32c8-42b7-82bc-daa82404023b'

Related links

• Open in Graph Explorer
• authorizationPolicy resource type - Microsoft Graph v1.0 | Microsoft Learn
• View in Microsoft Entra admin center

MITRE ATT&CK

mindmap
  root{{MITRE ATT&CK}}
    (Tactic)
      TA0043 - Reconnaissance - Reconnaissance
    (Mitigation)

    (Technique)

Tactic	Technique	Mitigation
TA0043 - Reconnaissance - Reconnaissance

---

Mito check, based on EIDSCA. Author: Cloud-Architekt. Open-source licences.