For a Microsoft Azure business-to-business (B2B) collaboration, each Microsoft Entra ID guest user needs to be associated with a business owner or business process. Ensure that there are no unassociated Microsoft Entra ID guest users within your Microsoft Azure account when there is no need for B2B collaboration.
id: azure-entra-id-guest-users-unmonitored
info:
name: Azure Entra ID Guest Users Unmonitored
author: princechaddha
severity: medium
description: |
For a Microsoft Azure business-to-business (B2B) collaboration, each Microsoft Entra ID guest user needs to be associated with a business owner or business process. Ensure that there are no unassociated Microsoft Entra ID guest users within your Microsoft Azure account when there is no need for B2B collaboration.
impact: |
Presence of unmonitored Microsoft Entra ID guest users can lead to unauthorized access and potential security risks within the Azure environment.
remediation: |
Regularly review and monitor guest users in Microsoft Entra ID to ensure each is associated with a business owner or process. Remove any unnecessary guest user accounts.
reference:
- https://docs.microsoft.com/en-us/azure/active-directory/external-identities/
tags: cloud,devops,azure,microsoft,entra-id,azure-cloud-config
self-contained: true
code:
- engine:
- sh
- bash
source: |
az ad user list --query "[?userType=='Guest']" --output json
matchers:
- type: word
words:
- '"userType": "Guest"'
extractors:
- type: dsl
dsl:
- '"Azure Account han an Entra ID guest user Microsoft Entra ID"'
# digest: 490a0046304402201deaeaf272ddbd2c7c056f375dcdd2059e8af91f678849051caa58dc9f46dd9102204007bf0d7302173e6b864e8fe89cf834e2a53d6d640d1fab3af5c154cd7bee5a:922c64590222798bb761d5b6d8e72950
# Visit https://trap.biu.life/ to view exploit trends for this vulnerability.