Microsoft Entra tenant with unsecure Guest user access permissions

This setting allows attackers to use tools like AADInternals to enumerate groups and users in the tenant, which can be used for reconnaissance. Although it doesn't grant direct access or elevation of privileges, it still increases the attack surface.

Attackers can use tools like AADInternals to enumerate groups and users in the tenant, which can be used for reconnaissance and planning future malicious operations. This information can also be used to target specific identities or groups.

Cayosoft Guardian continuously monitors the configuration of Guest user access restrictions in the Microsoft Entra ID tenant, flagging any settings that allow unrestricted access to groups and users.

Cayosoft Guardian alerts administrators to modify the Guest user access restrictions in the External Identities > External collaboration settings, limiting the attack surface and reducing the opportunities for unauthorized enumeration.