What it decides
- Rule
ENTRA-GUEST-001- Applies to
entra·authorization-policy- Default severity
- high
- Basis
- documented-guidance
On what authority
Microsoft publishes a closed set: `guestUserRoleId` "represents role templateId for the role that should be granted to guests" and "currently following roles are supported: User, Guest User, and Restricted Guest User". Three values, and the identifiers are Microsoft's. THE FINDING IS WHICH OF THE THREE. `User` is not a guest role that happens to be permissive; it is the member role. A directory holding it has decided that being invited and being employed grant the same read of the organisation, and most organisations that hold it have not decided that -- they inherited it.
What it needs to decide
authorization_policy.guest_role_template_id
Without these facts the rule answers unknown, which is not a pass and is not a failure: it is the rule saying the evidence could not settle the question.
Where the evidence comes from
tenant-governance: what every user in a tenant may do without asking, and how many accounts hold the role that may do anything · live-validated
What a pass does not establish
THE ROLE IS NOT THE ACCESS. This reads what a guest is granted in the directory and says nothing about what any guest can reach in SharePoint, Teams or anywhere a resource was shared with them. A narrow role here does not narrow a sharing link.
- The value is tenant-wide and applies to guests as a population. A guest who was additionally assigned a directory role holds that role regardless of this setting, and this rule does not read role assignments.
- Guests can also arrive through paths this setting governs but does not bound, including access packages and cross-tenant access settings.
Source
The rule as the Engine holds it, at the revision this page was generated from: 1.0.0b10@0c269e9d29d0.
Generated from capability-manifest/1.0.0 at 1.0.0b10@0c269e9d29d0, contract 1.0.0b10. Every fact on this page is the Engine's; this site publishes it and does not maintain it.