lacework-global-590
Set 'Guest invite restrictions' to "Only users assigned to specific admin roles can invite guest users" (Manual)
Profile Applicability
• Level 2
Description
Restrict invitations to users with specific administrative roles only.
Rationale
Restricting invitations to users with specific administrator roles ensures that only authorized accounts have access to cloud resources. This helps to maintain "Need to Know" permissions and prevents inadvertent access to data.
By default the setting Guest invite restrictions
is set to Anyone in the organization can invite guest users including guests and non-admins
. This would allow anyone within the organization to invite guests and non-admins to the tenant, posing a security risk.
Impact
With the option of Only users assigned to specific admin roles can invite guest users
selected, users with specific admin roles will be in charge of sending invitations to the Azure Workspace, requiring additional overhead by them to manage user accounts. This will mean coordinating with other departments as they are onboarding new users, and manually removing access from users who no longer need it.
Audit
From Azure Portal
- From Azure Home select the Portal Menu
- Select
Azure Active Directory
- Then
External Identities
External collaboration settings
- Under
Guest invite settings
, forGuest invite restrictions
, ensure that thatOnly users assigned to specific admin roles can invite guest users
is selected
Please note that at this point of time, there is no API/CLI mechanism available to programmatically conduct security assessment for this recommendation.
Note: This setting has 4 levels of restriction, which include:
- Anyone in the organization can invite guest users including guests and non-admins (most inclusive),
- Member users and users assigned to specific admin roles can invite guest users including guests with member permissions,
- Only users assigned to specific admin roles can invite guest users,
- No one in the organization can invite guest users including admins (most restrictive).
Remediation
From Azure Portal
- From Azure Home select the Portal Menu.
- Select Azure Active Directory.
- Select External Identities.
- Select External collaboration settings.
- Under Guest invite settings, for Guest invite restrictions, select Only users assigned to specific admin roles can invite guest users.
References
https://docs.microsoft.com/en-us/azure/active-directory/active-directory-b2b-delegate-invitations
https://docs.microsoft.com/en-us/security/benchmark/azure/security-controls-v3-governance-strategy#gs-6-define-identity-and-privileged-access-strategy
https://docs.microsoft.com/en-us/security/benchmark/azure/security-controls-v3-governance-strategy#gs-2-define-enterprise-segmentation-strategy
https://docs.microsoft.com/en-us/security/benchmark/azure/security-controls-v3-privileged-access#pa-5-automate-entitlement-management