CreativeTechsBaseline
tenant security posture
CTB-12 · Tier 1 · Silent · M365 / GWS

Restrict directory read for members and guests

EIDSCA AP07Huntress Guest access restrictions · HighMaester MT.1069 / MT.10552 authorities
0
Tenants failing
0
Tenants meeting
0
Measured
REQUIRED
Disposition
The settingWhat we hold this to
CreativeTechs minimum
guestUserRoleId = 2af84b1e-32c8-42b7-82bc-daa82404023b (most restrictive). Restrict access to Entra admin portal = Yes. Non-admins cannot create security groups or M365 groups unless the client's workflow requires it and an exception is recorded.
Benchmark position
EIDSCA.AP07 — recommended value '2af84b1e-32c8-42b7-82bc-daa82404023b'. CISA SCuBA 2.18 — guests SHOULD have limited access to directory objects. Our minimum matches.
Where we differ, and why
Live finding: the CreativeTechs tenant is currently 10dae51f-b6af-4016-8d66-8c2a99b929b3, the more permissive role.
Where the switch is
Entra admin centre → Identity → External Identities → External collaboration settings → Guest user access. Portal restriction: Identity → Users → User settings.
https://entra.microsoft.com
How to verify
Graph: /policies/authorizationPolicy  →  guestUserRoleId eq '2af84b1e-32c8-42b7-82bc-daa82404023b'
Across the fleet
Client
State
Evidence
Blackwing
UNKNOWN
No Secure Score evidence — awaiting Maester.
BravicaOne
UNKNOWN
No Secure Score evidence — awaiting Maester.
CMG Law
UNKNOWN
No Secure Score evidence — awaiting Maester.
CreativeTechs
UNKNOWN
No Secure Score evidence — awaiting Maester.
DCG One
UNKNOWN
No Secure Score evidence — awaiting Maester.
Diversified Management Services
UNKNOWN
No Secure Score evidence — awaiting Maester.
Double Z
UNKNOWN
No Secure Score evidence — awaiting Maester.
Electric Pen
UNKNOWN
No Secure Score evidence — awaiting Maester.
Graphiti Associates
UNKNOWN
No Secure Score evidence — awaiting Maester.
Guidance Engineering
UNKNOWN
No Secure Score evidence — awaiting Maester.
India Tree
UNKNOWN
No Secure Score evidence — awaiting Maester.
MIR Corp
UNKNOWN
No Secure Score evidence — awaiting Maester.
Phinney Bischoff
UNKNOWN
No Secure Score evidence — awaiting Maester.
Quiver Dental
UNKNOWN
No Secure Score evidence — awaiting Maester.
RHO Architects
UNKNOWN
No Secure Score evidence — awaiting Maester.
Retail Voodoo
UNKNOWN
No Secure Score evidence — awaiting Maester.
Riverstone
UNKNOWN
No Secure Score evidence — awaiting Maester.
SSF
UNKNOWN
No Secure Score evidence — awaiting Maester.
Slingshot Architecture
UNKNOWN
No Secure Score evidence — awaiting Maester.
Stoke
UNKNOWN
No Secure Score evidence — awaiting Maester.
Turnstyle
UNKNOWN
No Secure Score evidence — awaiting Maester.
Urban Animal
UNKNOWN
No Secure Score evidence — awaiting Maester.
WLIHA
UNKNOWN
No Secure Score evidence — awaiting Maester.
Zak Designs
UNKNOWN
No Secure Score evidence — awaiting Maester.
Why it matters
By default a member can enumerate the full directory. After one account falls, that's the reconnaissance step handed over for free.
How we check
Maester EIDSCA.AP07, MT.1069, MT.1055.
Fix — M365
Entra → User settings → restrict access to the admin portal; External collaboration → guest access most restrictive. Restrict non-admin group and Teams creation where it doesn't fight the client's workflow.
Fix — Google
Admin → Directory settings → limit contact sharing scope.
User notices
Users can no longer browse the full org list from the portal. Address-book lookup in mail still works.
Expected pushback
Low. Group-creation restriction is the part that can annoy — decide per client.