What the Engine publishes
Generated from the Engine's capability manifest at 1.0.0b10@0c269e9d29d0. No value on this panel is maintained by this site.
- Answers
- the guest accounts in the directory, by object id and never by name
- Collector
- Microsoft Graph · mode
Guests - Reads
GET /v1.0/users?$filter=userType eq 'Guest' ($select of six properties, none of which names a person)
- Least privilege
User.Read.All
- Produces
entra·tenant- Proven against a tenant
- live-validated
Rules that decide from it
No rule reads this evidence, and that is a recorded decision rather than a gap: the guest list an operator enumerates, and the external access inspection is what consumes it. A threshold invented for a surface Microsoft publishes no position on would make a pass mean nothing.
Contracts it produces
Every collection writes evidence and an account of itself. The manifest publishes no narrower per-capability list, so this states what it does establish rather than guessing at more.
Source
The Engine's own definition of this collector, at the revision this page was generated from:1.0.0b10@0c269e9d29d0.
Generated from capability-manifest/1.0.0 at 1.0.0b10@0c269e9d29d0, contract 1.0.0b10. Every fact on this page is the Engine's; this site publishes it and does not maintain it.