The settingWhat we hold this to
CreativeTechs minimum
A CA policy in state ENABLED targeting Guest and external users, grant = Require MFA. Guest invitations restricted to admins and the guest-inviter role.
Benchmark position
No single published numeric value; CISA and CIS both cover guest restriction qualitatively. Huntress carries four guest controls, mostly High.
Where the switch is
Entra admin centre → Protection → Conditional Access → Policies → New policy → Users → Guest or external users. Invitations: Identity → External Identities → External collaboration settings.
How to verify
Graph: /policies/authorizationPolicy → allowInvitesFrom eq 'adminsAndGuestInviters'
- Why it matters
- Guests hold real access to real data and sit entirely outside the client's identity controls unless we say otherwise.
- How we check
- Maester MT.1016.
- Fix — M365
- CA policy targeting guest and external users → require MFA. External collaboration settings → limit who can invite.
- Fix — Google
- Admin → Drive and Docs → restrict external sharing to allowlisted domains.
- User notices
- External collaborators do an MFA enrolment before they can open a shared file.
- Expected pushback
- Real friction on client and vendor collaboration at agencies. Consider scoping to guests reaching SharePoint and Teams rather than everything.