Microsoft Entra tenant configured to allow guests to invite other guests

This setting is rated medium severity because it allows attackers to gather information about users, groups, and the environment, which can support later attacker activity. The potential for reconnaissance and data collection poses a meaningful threat.

An attacker can sign in using a guest account and perform reconnaissance against the tenant by gathering information about users, groups, and the environment. This discovery activity may go unnoticed because guest access can appear as ordinary low-privilege traffic.

Cayosoft Guardian detects this setting by continuously monitoring the guest invitation configuration across the tenant and flagging it as a security issue when enabled.

Cayosoft Guardian helps reduce the risk by alerting administrators to modify the guest invitation settings in the Microsoft Entra admin center, limiting the ability for guest users to invite other guest users and reducing potential reconnaissance opportunities available to attackers.