What it decides

Rule
ENTRA-AUTH-001
Applies to
entra · authorization-policy
Default severity
medium
Basis
documented-guidance

On what authority

Microsoft defines the value rather than judging it, and the definition is the finding: `everyone` means "Allow everyone in the organization, including guests, to invite guests." The narrower documented values exist for organisations that want the same collaboration with a boundary -- `adminsGuestInvitersAndAllMembers` keeps members inviting and stops guests, and `adminsAndGuestInviters` keeps it with the roles. THIS RULE REPORTS THE REACH OF THE SETTING AND DOES NOT SAY IT IS WRONG. An organisation whose work is external collaboration may hold `everyone` deliberately. What it should not do is hold it without knowing that the population who may extend the directory is not the population it employs.

What it needs to decide

  • authorization_policy.guest_invitations_from

Without these facts the rule answers unknown, which is not a pass and is not a failure: it is the rule saying the evidence could not settle the question.

Where the evidence comes from

  • tenant-governance: what every user in a tenant may do without asking, and how many accounts hold the role that may do anything · live-validated

What a pass does not establish

WHO MAY INVITE IS NOT WHO WAS INVITED. This reads one setting and says nothing about how many guests exist, who invited them, whether they are still needed, or what they can reach. A tenant that closed this setting yesterday still holds every guest invited before.

  • Guest access can also be granted through paths this setting does not govern, including access packages, cross-tenant access settings, and the sharing controls of individual workloads. A narrower value here is not a boundary around the whole tenant.
  • The role a guest receives, and therefore what they can read of the directory, is a separate setting on the same policy. This rule reads who may invite and not what an invitation grants.

Source

The rule as the Engine holds it, at the revision this page was generated from: 1.0.0b10@0c269e9d29d0.

Generated from capability-manifest/1.0.0 at 1.0.0b10@0c269e9d29d0, contract 1.0.0b10. Every fact on this page is the Engine's; this site publishes it and does not maintain it.