Skip to content
MitoMito Docs

EIDSCA.AP04: Default Authorization Settings - Guest invite restrictions.
ID EIDSCA.AP04
Severity Medium
Suite EIDSCA
Product Entra ID
Feature External identities
Security area External access and sharing
Resource type Tenant
User impact of fixing Medium
Effort to fix Low
Framework controls nist-800-53-r5:AC-6(10) Least Privilege | Prohibit Non-privileged Users from Executing Privileged Functions
MITRE ATT&CK T1136.003
Reads from Microsoft Graph

What this checks and how to fix it

Section titled “What this checks and how to fix it”

Manages controls who can invite guests to your directory to collaborate on resources secured by your Entra ID (Azure AD), such as SharePoint sites or Azure resources.

CISA SCuBA 2.18: Only users with the Guest Inviter role SHOULD be able to invite guest users

Test script

Section titled “Test script”
https://graph.microsoft.com/beta/policies/authorizationPolicy
.allowInvitesFrom -in @('adminsAndGuestInviters','none')
Section titled “Related links”

MITRE ATT&CK

Section titled “MITRE ATT&CK”
mindmap
  root{{MITRE ATT&CK}}
    (Tactic)
      TA0003 - Persistence - Persistence
    (Mitigation)


    (Technique)
Tactic Technique Mitigation
TA0003 - Persistence - Persistence

Mito check, based on EIDSCA. Author: Cloud-Architekt. Open-source licences.

Open-source licences. CIS Benchmark material © Center for Internet Security, Inc.; CISA SCuBA baselines are public domain (CC0).

© 2026 Virtual Petals. Mito is a Virtual Petals service, hosted in Microsoft Azure UAE North.