EIDSCA.ST08: Default Settings - Classification and M365 Groups - M365 groups - Allow Guests to become Group Owner.
| ID | EIDSCA.ST08 |
| Severity | Medium |
| Suite | EIDSCA |
| Product | Entra ID |
| Feature | Groups |
| Security area | External access and sharing |
| Resource type | Tenant |
| User impact of fixing | Low |
| Effort to fix | Low |
| Framework controls | nist-800-53-r5:AC-6 Least Privilege |
| MITRE ATT&CK | T1098 |
| Reads from | Microsoft Graph |
What this checks and how to fix it
Section titled “What this checks and how to fix it”Indicating whether or not a guest user can be an owner of groups, manage
CISA SCuBA 2.18: Guest users SHOULD have limited access to Entra ID (Azure AD) directory objects
Test script
Section titled “Test script”https://graph.microsoft.com/beta/settings.values -eq 'false'Remediation action
Section titled “Remediation action”Microsoft Learn - Microsoft Entra cmdlets for configuring group settings
Related links
Section titled “Related links”Mito check, based on EIDSCA. Author: Cloud-Architekt. Open-source licences.
Open-source licences. CIS Benchmark material © Center for Internet Security, Inc.; CISA SCuBA baselines are public domain (CC0).
© 2026 Virtual Petals. Mito is a Virtual Petals service, hosted in Microsoft Azure UAE North.