Skip to content
MitoMito Docs

EIDSCA.AP14: Default Authorization Settings - Default User Role Permissions - Allowed to read other users.
ID EIDSCA.AP14
Severity Low
Suite EIDSCA
Product Entra ID
Feature User and directory settings
Security area Access control
Resource type Tenant
User impact of fixing Low
Effort to fix Low
Framework controls nist-800-53-r5:AC-3 Access Enforcement
Reads from Microsoft Graph

What this checks and how to fix it

Section titled “What this checks and how to fix it”

Prevents all non-admins from reading user information from the directory. This flag doesn’t prevent reading user information in other Microsoft services like Exchange Online.

Restrict this default permissions for members have huge impact on collaboration features and user lookup.

Test script

Section titled “Test script”
https://graph.microsoft.com/beta/policies/authorizationPolicy
.defaultUserRolePermissions.allowedToReadOtherUsers -eq 'true'

Remediation action

Section titled “Remediation action”

Microsoft Graph PowerShell: PolicyAuthorizationPolicy -BodyParameter @{DefaultUserRolePermissions = @{AllowedToReadOtherUsers = $false}}

Section titled “Related links”

MITRE ATT&CK

Section titled “MITRE ATT&CK”
mindmap
  root{{MITRE ATT&CK}}
    (Tactic)
      TA0043 - Reconnaissance - Reconnaissance
    (Mitigation)


    (Technique)
Tactic Technique Mitigation
TA0043 - Reconnaissance - Reconnaissance

Mito check, based on EIDSCA. Author: Cloud-Architekt. Open-source licences.

Open-source licences. CIS Benchmark material © Center for Internet Security, Inc.; CISA SCuBA baselines are public domain (CC0).

© 2026 Virtual Petals. Mito is a Virtual Petals service, hosted in Microsoft Azure UAE North.