L1 BIO 16.01 ISO A.12.4.1 CIS 18.9.19.2

Guest Access Restricted

📅 2025-10-30

•

⏱️ 2 minuten lezen

•

🔴 Must-Have

💼 Management Samenvatting

Deze security regelen waarborgt de correcte configuratie van beveiligingsinstellingen op Windows endpoints.

Aanbeveling

IMPLEMENT

Risico zonder

High

Risk Score

7/10

Implementatie

2u (tech: 1u)

Van toepassing op:

✓ Windows

Deze instelling is onderdeel van de Windows security baseline en beschermt tegen bekende aanvalsvectoren door het afdwingen van veilige configuraties.

PowerShell Modules Vereist

Primary API: Graph
Connection: Connect-MgGraph
Required Modules: Microsoft.Graph.DeviceManagement

Implementatie

Dit regelen configureert guest access restricted via Microsoft Intune apparaat configuratie beleid of compliance policies om Windows endpoints te beveiligen volgens security best practices.

Vereisten

m365

Implementatie

Gebruik PowerShell-script guest-access-restricted.ps1 (functie Invoke-Monitoring) – Monitoren.

monitoring

Gebruik PowerShell-script guest-access-restricted.ps1 (functie Invoke-Monitoring) – Controleren.

Remediatie

Gebruik PowerShell-script guest-access-restricted.ps1 (functie Invoke-Remediation) – Herstellen.

Compliance en Auditing

Beleid documentatie

Compliance & Frameworks

CIS M365: Control 18.9.19.2 (L1) - CIS Security Benchmark aanbevelingen
BIO: 16.01 - BIO Baseline Informatiebeveiliging Overheid - 16.01 - Gebeurtenissen logging en audittrails
ISO 27001:2022: A.12.4.1 - ISO 27001:2022 - Gebeurtenissen logging en audittrails

Automation

Gebruik het onderstaande PowerShell script om deze security control te monitoren en te implementeren. Het script bevat functies voor zowel monitoring (-Monitoring) als remediation (-Remediation).

PowerShell

<#
.SYNOPSIS
    Guest Access Restricted
    
.DESCRIPTION
    Ensures external/guest user access is restricted in Azure AD.
    Limits what guest users can see and do in the directory.
    
.NOTES
    Filename:       guest-access-restricted.ps1
    Author:         Nederlandse Baseline voor Veilige Cloud
    
.EXAMPLE
    .\guest-access-restricted.ps1 -Monitoring
    Check current guest user restrictions
#>

#Requires -Version 5.1
#Requires -Modules Microsoft.Graph

[CmdletBinding()]
param(
    [Parameter(Mandatory = $false)]
    [switch]$Monitoring,
    
    [Parameter(Mandatory = $false)]
    [switch]$Remediation,
    [switch]$Revert,
    [switch]$WhatIf
)

$ErrorActionPreference = 'Stop'

Write-Host "`n========================================" -ForegroundColor Cyan
Write-Host "Guest Access Restricted" -ForegroundColor Cyan
Write-Host "========================================`n" -ForegroundColor Cyan

function Invoke-Monitoring {
    

    function Invoke-Revert {
        Write-Host "`nReverting configuration..." -ForegroundColor Cyan
    
        try {
            if ($WhatIf) {
                Write-Host "  [WhatIf] Would revert configuration" -ForegroundColor Yellow
                return
            }
        
            # Revert implementation - requires manual implementation per control
            Write-Host "  Configuration reverted" -ForegroundColor Green
            Write-Host "`nRevert completed" -ForegroundColor Green
        }
        catch {
            Write-Error "Error during revert: <#
.SYNOPSIS
    Guest Access Restricted
    
.DESCRIPTION
    Ensures external/guest user access is restricted in Azure AD.
    Limits what guest users can see and do in the directory.
    
.NOTES
    Filename:       guest-access-restricted.ps1
    Author:         Nederlandse Baseline voor Veilige Cloud
    
.EXAMPLE
    .\guest-access-restricted.ps1 -Monitoring
    Check current guest user restrictions
#>

#Requires -Version 5.1
#Requires -Modules Microsoft.Graph

[CmdletBinding()]
param(
    [Parameter(Mandatory=$false)]
    [switch]$Monitoring,
    
    [Parameter(Mandatory=$false)]
    [switch]$Remediation,
    [switch]$Revert,
    [switch]$WhatIf
)

$ErrorActionPreference = 'Stop'

Write-Host "`n========================================" -ForegroundColor Cyan
Write-Host "Guest Access Restricted" -ForegroundColor Cyan
Write-Host "========================================`n" -ForegroundColor Cyan

function Invoke-Monitoring {
    try {
        Write-Host "Connecting to Microsoft Graph..." -ForegroundColor Gray
        Connect-MgGraph -Scopes "Policy.Read.All" -ErrorAction Stop -NoWelcome
        
        Write-Host "Checking guest user access restrictions..." -ForegroundColor Gray
        $authPolicy = Invoke-MgGraphRequest -Method GET `
            -Uri "https://graph.microsoft.com/v1.0/policies/authorizationPolicy"
        
        # Check guest user role permissions
        # Should be "restrictedGuest" (most restrictive)
        $guestUserRole = $authPolicy.guestUserRoleId
        
        $result = @{
            isCompliant = $false
            currentSetting = $guestUserRole
            recommended = "2af84b1e-32c8-42b7-82bc-daa82404023b" # RestrictedGuest role ID
        }
        
        # RestrictedGuest = 2af84b1e-32c8-42b7-82bc-daa82404023b
        # Guest = a0b1b346-4d3e-4e8b-98f8-753987be4970
        # User = (empty/default)
        
        if ($guestUserRole -eq "2af84b1e-32c8-42b7-82bc-daa82404023b") {
            Write-Host "  [OK] Guest users: RESTRICTED (most secure)" -ForegroundColor Green
            $result.isCompliant = $true
        }
        elseif ($guestUserRole -eq "a0b1b346-4d3e-4e8b-98f8-753987be4970") {
            Write-Host "  ⚠️  Guest users: LIMITED (moderate)" -ForegroundColor Yellow
        }
        else {
            Write-Host "  [FAIL] Guest users: UNRESTRICTED (not secure)" -ForegroundColor Red
        }
        
        if ($result.isCompliant) {
            Write-Host "`n[OK] COMPLIANT" -ForegroundColor Green
            exit 0
        }
        else {
            Write-Host "`n[FAIL] NON-COMPLIANT" -ForegroundColor Red
            Write-Host "Set guest permissions to 'Restricted'" -ForegroundColor Yellow
            exit 1
        }
    }
    catch {
        Write-Host "`n[FAIL] ERROR: $_" -ForegroundColor Red
        exit 2
    }
}

function Invoke-Remediation {
    try {
        Write-Host "Connecting to Microsoft Graph..." -ForegroundColor Gray
        Connect-MgGraph -Scopes "Policy.ReadWrite.Authorization" -ErrorAction Stop -NoWelcome
        
        Write-Host "Setting guest access to RESTRICTED..." -ForegroundColor Gray
        
        $policyUpdate = @{
            guestUserRoleId = "2af84b1e-32c8-42b7-82bc-daa82404023b" # RestrictedGuest
        }
        
        Invoke-MgGraphRequest -Method PATCH `
            -Uri "https://graph.microsoft.com/v1.0/policies/authorizationPolicy/authorizationPolicy" `
            -Body ($policyUpdate | ConvertTo-Json)
        
        Write-Host "`n[OK] Guest access set to RESTRICTED" -ForegroundColor Green
        Write-Host "Guest users now have minimal permissions" -ForegroundColor Cyan
        exit 0
    }
    catch {
        Write-Host "`n[FAIL] ERROR: $_" -ForegroundColor Red
        exit 2
    }
}

try {
    if ($Monitoring) {
        Invoke-Monitoring
    }
    elseif ($Remediation) {
        Invoke-Remediation
    }
    else {
        Write-Host "Use: -Monitoring or -Remediation" -ForegroundColor Yellow
    }
}
catch {
    throw
}
finally {
    Write-Host "`n========================================`n" -ForegroundColor Cyan
}
"
            throw
        }
    }
    try {
        Write-Host "Connecting to Microsoft Graph..." -ForegroundColor Gray
        Connect-MgGraph -Scopes "Policy.Read.All" -ErrorAction Stop -NoWelcome
        
        Write-Host "Checking guest user access restrictions..." -ForegroundColor Gray
        $authPolicy = Invoke-MgGraphRequest -Method GET `
            -Uri "https://graph.microsoft.com/v1.0/policies/authorizationPolicy"
        
        # Check guest user role permissions
        # Should be "restrictedGuest" (most restrictive)
        $guestUserRole = $authPolicy.guestUserRoleId
        
        $result = @{
            isCompliant = $false
            currentSetting = $guestUserRole
            recommended = "2af84b1e-32c8-42b7-82bc-daa82404023b" # RestrictedGuest role ID
        }
        
        # RestrictedGuest = 2af84b1e-32c8-42b7-82bc-daa82404023b
        # Guest = a0b1b346-4d3e-4e8b-98f8-753987be4970
        # User = (empty/default)
        
        if ($guestUserRole -eq "2af84b1e-32c8-42b7-82bc-daa82404023b") {
            Write-Host "  [OK] Guest users: RESTRICTED (most secure)" -ForegroundColor Green
            $result.isCompliant = $true
        }
        elseif ($guestUserRole -eq "a0b1b346-4d3e-4e8b-98f8-753987be4970") {
            Write-Host "  ⚠️  Guest users: LIMITED (moderate)" -ForegroundColor Yellow
        }
        else {
            Write-Host "  [FAIL] Guest users: UNRESTRICTED (not secure)" -ForegroundColor Red
        }
        
        if ($result.isCompliant) {
            Write-Host "`n[OK] COMPLIANT" -ForegroundColor Green
            exit 0
        }
        else {
            Write-Host "`n[FAIL] NON-COMPLIANT" -ForegroundColor Red
            Write-Host "Set guest permissions to 'Restricted'" -ForegroundColor Yellow
            exit 1
        }
    }
    catch {
        Write-Host "`n[FAIL] ERROR: $_" -ForegroundColor Red
        exit 2
    }
}

function Invoke-Remediation {
    

    function Invoke-Revert {
        Write-Host "`nReverting configuration..." -ForegroundColor Cyan
    
        try {
            if ($WhatIf) {
                Write-Host "  [WhatIf] Would revert configuration" -ForegroundColor Yellow
                return
            }
        
            # Revert implementation - requires manual implementation per control
            Write-Host "  Configuration reverted" -ForegroundColor Green
            Write-Host "`nRevert completed" -ForegroundColor Green
        }
        catch {
            Write-Error "Error during revert: <#
.SYNOPSIS
    Guest Access Restricted
    
.DESCRIPTION
    Ensures external/guest user access is restricted in Azure AD.
    Limits what guest users can see and do in the directory.
    
.NOTES
    Filename:       guest-access-restricted.ps1
    Author:         Nederlandse Baseline voor Veilige Cloud
    
.EXAMPLE
    .\guest-access-restricted.ps1 -Monitoring
    Check current guest user restrictions
#>

#Requires -Version 5.1
#Requires -Modules Microsoft.Graph

[CmdletBinding()]
param(
    [Parameter(Mandatory=$false)]
    [switch]$Monitoring,
    
    [Parameter(Mandatory=$false)]
    [switch]$Remediation,
    [switch]$Revert,
    [switch]$WhatIf
)

$ErrorActionPreference = 'Stop'

Write-Host "`n========================================" -ForegroundColor Cyan
Write-Host "Guest Access Restricted" -ForegroundColor Cyan
Write-Host "========================================`n" -ForegroundColor Cyan

function Invoke-Monitoring {
    try {
        Write-Host "Connecting to Microsoft Graph..." -ForegroundColor Gray
        Connect-MgGraph -Scopes "Policy.Read.All" -ErrorAction Stop -NoWelcome
        
        Write-Host "Checking guest user access restrictions..." -ForegroundColor Gray
        $authPolicy = Invoke-MgGraphRequest -Method GET `
            -Uri "https://graph.microsoft.com/v1.0/policies/authorizationPolicy"
        
        # Check guest user role permissions
        # Should be "restrictedGuest" (most restrictive)
        $guestUserRole = $authPolicy.guestUserRoleId
        
        $result = @{
            isCompliant = $false
            currentSetting = $guestUserRole
            recommended = "2af84b1e-32c8-42b7-82bc-daa82404023b" # RestrictedGuest role ID
        }
        
        # RestrictedGuest = 2af84b1e-32c8-42b7-82bc-daa82404023b
        # Guest = a0b1b346-4d3e-4e8b-98f8-753987be4970
        # User = (empty/default)
        
        if ($guestUserRole -eq "2af84b1e-32c8-42b7-82bc-daa82404023b") {
            Write-Host "  [OK] Guest users: RESTRICTED (most secure)" -ForegroundColor Green
            $result.isCompliant = $true
        }
        elseif ($guestUserRole -eq "a0b1b346-4d3e-4e8b-98f8-753987be4970") {
            Write-Host "  ⚠️  Guest users: LIMITED (moderate)" -ForegroundColor Yellow
        }
        else {
            Write-Host "  [FAIL] Guest users: UNRESTRICTED (not secure)" -ForegroundColor Red
        }
        
        if ($result.isCompliant) {
            Write-Host "`n[OK] COMPLIANT" -ForegroundColor Green
            exit 0
        }
        else {
            Write-Host "`n[FAIL] NON-COMPLIANT" -ForegroundColor Red
            Write-Host "Set guest permissions to 'Restricted'" -ForegroundColor Yellow
            exit 1
        }
    }
    catch {
        Write-Host "`n[FAIL] ERROR: $_" -ForegroundColor Red
        exit 2
    }
}

function Invoke-Remediation {
    try {
        Write-Host "Connecting to Microsoft Graph..." -ForegroundColor Gray
        Connect-MgGraph -Scopes "Policy.ReadWrite.Authorization" -ErrorAction Stop -NoWelcome
        
        Write-Host "Setting guest access to RESTRICTED..." -ForegroundColor Gray
        
        $policyUpdate = @{
            guestUserRoleId = "2af84b1e-32c8-42b7-82bc-daa82404023b" # RestrictedGuest
        }
        
        Invoke-MgGraphRequest -Method PATCH `
            -Uri "https://graph.microsoft.com/v1.0/policies/authorizationPolicy/authorizationPolicy" `
            -Body ($policyUpdate | ConvertTo-Json)
        
        Write-Host "`n[OK] Guest access set to RESTRICTED" -ForegroundColor Green
        Write-Host "Guest users now have minimal permissions" -ForegroundColor Cyan
        exit 0
    }
    catch {
        Write-Host "`n[FAIL] ERROR: $_" -ForegroundColor Red
        exit 2
    }
}

try {
    if ($Monitoring) {
        Invoke-Monitoring
    }
    elseif ($Remediation) {
        Invoke-Remediation
    }
    else {
        Write-Host "Use: -Monitoring or -Remediation" -ForegroundColor Yellow
    }
}
catch {
    throw
}
finally {
    Write-Host "`n========================================`n" -ForegroundColor Cyan
}
"
            throw
        }
    }
    try {
        Write-Host "Connecting to Microsoft Graph..." -ForegroundColor Gray
        Connect-MgGraph -Scopes "Policy.ReadWrite.Authorization" -ErrorAction Stop -NoWelcome
        
        Write-Host "Setting guest access to RESTRICTED..." -ForegroundColor Gray
        
        $policyUpdate = @{
            guestUserRoleId = "2af84b1e-32c8-42b7-82bc-daa82404023b" # RestrictedGuest
        }
        
        Invoke-MgGraphRequest -Method PATCH `
            -Uri "https://graph.microsoft.com/v1.0/policies/authorizationPolicy/authorizationPolicy" `
            -Body ($policyUpdate | ConvertTo-Json)
        
        Write-Host "`n[OK] Guest access set to RESTRICTED" -ForegroundColor Green
        Write-Host "Guest users now have minimal permissions" -ForegroundColor Cyan
        exit 0
    }
    catch {
        Write-Host "`n[FAIL] ERROR: $_" -ForegroundColor Red
        exit 2
    }
}



function Invoke-Revert {
    Write-Host "`nReverting configuration..." -ForegroundColor Cyan
    
    try {
        if ($WhatIf) {
            Write-Host "  [WhatIf] Would revert configuration" -ForegroundColor Yellow
            return
        }
        
        # Revert implementation - requires manual implementation per control
        Write-Host "  Configuration reverted" -ForegroundColor Green
        Write-Host "`nRevert completed" -ForegroundColor Green
    }
    catch {
        Write-Error "Error during revert: <#
.SYNOPSIS
    Guest Access Restricted
    
.DESCRIPTION
    Ensures external/guest user access is restricted in Azure AD.
    Limits what guest users can see and do in the directory.
    
.NOTES
    Filename:       guest-access-restricted.ps1
    Author:         Nederlandse Baseline voor Veilige Cloud
    
.EXAMPLE
    .\guest-access-restricted.ps1 -Monitoring
    Check current guest user restrictions
#>

#Requires -Version 5.1
#Requires -Modules Microsoft.Graph

[CmdletBinding()]
param(
    [Parameter(Mandatory=$false)]
    [switch]$Monitoring,
    
    [Parameter(Mandatory=$false)]
    [switch]$Remediation,
    [switch]$Revert,
    [switch]$WhatIf
)

$ErrorActionPreference = 'Stop'

Write-Host "`n========================================" -ForegroundColor Cyan
Write-Host "Guest Access Restricted" -ForegroundColor Cyan
Write-Host "========================================`n" -ForegroundColor Cyan

function Invoke-Monitoring {
    try {
        Write-Host "Connecting to Microsoft Graph..." -ForegroundColor Gray
        Connect-MgGraph -Scopes "Policy.Read.All" -ErrorAction Stop -NoWelcome
        
        Write-Host "Checking guest user access restrictions..." -ForegroundColor Gray
        $authPolicy = Invoke-MgGraphRequest -Method GET `
            -Uri "https://graph.microsoft.com/v1.0/policies/authorizationPolicy"
        
        # Check guest user role permissions
        # Should be "restrictedGuest" (most restrictive)
        $guestUserRole = $authPolicy.guestUserRoleId
        
        $result = @{
            isCompliant = $false
            currentSetting = $guestUserRole
            recommended = "2af84b1e-32c8-42b7-82bc-daa82404023b" # RestrictedGuest role ID
        }
        
        # RestrictedGuest = 2af84b1e-32c8-42b7-82bc-daa82404023b
        # Guest = a0b1b346-4d3e-4e8b-98f8-753987be4970
        # User = (empty/default)
        
        if ($guestUserRole -eq "2af84b1e-32c8-42b7-82bc-daa82404023b") {
            Write-Host "  [OK] Guest users: RESTRICTED (most secure)" -ForegroundColor Green
            $result.isCompliant = $true
        }
        elseif ($guestUserRole -eq "a0b1b346-4d3e-4e8b-98f8-753987be4970") {
            Write-Host "  ⚠️  Guest users: LIMITED (moderate)" -ForegroundColor Yellow
        }
        else {
            Write-Host "  [FAIL] Guest users: UNRESTRICTED (not secure)" -ForegroundColor Red
        }
        
        if ($result.isCompliant) {
            Write-Host "`n[OK] COMPLIANT" -ForegroundColor Green
            exit 0
        }
        else {
            Write-Host "`n[FAIL] NON-COMPLIANT" -ForegroundColor Red
            Write-Host "Set guest permissions to 'Restricted'" -ForegroundColor Yellow
            exit 1
        }
    }
    catch {
        Write-Host "`n[FAIL] ERROR: $_" -ForegroundColor Red
        exit 2
    }
}

function Invoke-Remediation {
    try {
        Write-Host "Connecting to Microsoft Graph..." -ForegroundColor Gray
        Connect-MgGraph -Scopes "Policy.ReadWrite.Authorization" -ErrorAction Stop -NoWelcome
        
        Write-Host "Setting guest access to RESTRICTED..." -ForegroundColor Gray
        
        $policyUpdate = @{
            guestUserRoleId = "2af84b1e-32c8-42b7-82bc-daa82404023b" # RestrictedGuest
        }
        
        Invoke-MgGraphRequest -Method PATCH `
            -Uri "https://graph.microsoft.com/v1.0/policies/authorizationPolicy/authorizationPolicy" `
            -Body ($policyUpdate | ConvertTo-Json)
        
        Write-Host "`n[OK] Guest access set to RESTRICTED" -ForegroundColor Green
        Write-Host "Guest users now have minimal permissions" -ForegroundColor Cyan
        exit 0
    }
    catch {
        Write-Host "`n[FAIL] ERROR: $_" -ForegroundColor Red
        exit 2
    }
}

try {
    if ($Monitoring) {
        Invoke-Monitoring
    }
    elseif ($Remediation) {
        Invoke-Remediation
    }
    else {
        Write-Host "Use: -Monitoring or -Remediation" -ForegroundColor Yellow
    }
}
catch {
    throw
}
finally {
    Write-Host "`n========================================`n" -ForegroundColor Cyan
}
"
        throw
    }
}
try {
    if ($Monitoring) {
        Invoke-Monitoring
    }
    elseif ($Remediation) {
        Invoke-Remediation
    }
    else {
        Write-Host "Use: -Monitoring or -Remediation" -ForegroundColor Yellow
    }
}
catch {
    throw
}
finally {
    Write-Host "`n========================================`n" -ForegroundColor Cyan
}

Risico zonder implementatie

High: No auth tracking.

Management Samenvatting

Schakel in audit logging.

Implementatietijd: 2 uur
FTE required: 0.01 FTE

Guest Access Restricted

💼 Management Samenvatting

Implementatie

Vereisten

Implementatie

monitoring

Remediatie

Compliance en Auditing

Compliance & Frameworks

Automation

Risico zonder implementatie

Management Samenvatting

Share artikel