EIDSCA.ST09: Default Settings - Classification and M365 Groups - M365 groups - Allow Guests to have access to groups content.
| ID | EIDSCA.ST09 |
| Severity | Low |
| Suite | EIDSCA |
| Product | Entra ID |
| Feature | Groups |
| Security area | External access and sharing |
| Resource type | Tenant |
| User impact of fixing | Low |
| Effort to fix | Low |
| Framework controls | nist-800-53-r5:AC-6 Least Privilegenist-800-53-r5:AC-21 Information Sharing |
| Reads from | Microsoft Graph |
What this checks and how to fix it
Section titled “What this checks and how to fix it”Indicating whether or not a guest user can have access to Microsoft 365 groups content. This setting does not require an Azure Active Directory Premium P1 license.
Manages if guest accounts can access resources through Microsoft 365 Group membership and could break collaboration if you disable it.
Test script
Section titled “Test script”https://graph.microsoft.com/beta/settings.values -eq 'True'Remediation action
Section titled “Remediation action”Microsoft Learn - Microsoft Entra cmdlets for configuring group settings
Related links
Section titled “Related links”Mito check, based on EIDSCA. Author: Cloud-Architekt. Open-source licences.
Open-source licences. CIS Benchmark material © Center for Internet Security, Inc.; CISA SCuBA baselines are public domain (CC0).
© 2026 Virtual Petals. Mito is a Virtual Petals service, hosted in Microsoft Azure UAE North.