CISA.MS.AAD.8.1: Guest users SHOULD have limited or restricted access to Entra ID directory objects.

ID	CISA.MS.AAD.8.1
Severity	Medium
Suite	CISA SCuBA baselines
Product	Entra ID
Feature	External identities
Security area	External access and sharing
Resource type	Tenant
User impact of fixing	Low
Effort to fix	Low
Benchmark	CISA SCuBA Secure Configuration Baselines for Microsoft 365 ScubaGear main, 2026-10-11, MS.AAD.8.1 (SHOULD)
Framework controls	cisa-scuba:MS.AAD.8.1 nist-800-53-r5:AC-6 Least Privilege
MITRE ATT&CK	T1087.003, T1087.004, T1526, T1069.003
Reads from	Microsoft Graph

What this checks and how to fix it

Guest users SHOULD have limited or restricted access to Azure AD directory objects.

Rationale: Limiting the amount of object information available to guest users in the tenant, reduces malicious reconnaissance exposure, should a guest account become compromised or be created by an adversary.

Remediation action

1. In Entra ID and External Identities, select External collaboration settings.
2. Under Guest user access, select either Guest users have limited access to properties and memberships of directory objects or Guest user access is restricted to properties and memberships of their own directory objects (most restrictive).
3. Click Save.

Related links

• Entra admin center - External Identities | External collaboration settings
• CISA Guest User Access - MS.AAD.8.1v1
• CISA ScubaGear Rego Reference

---

Mito check, based on CISA ScubaGear. Author: soulemike; contributors: merill. Open-source licences.