Guest user with AD roles
Guest Users With AD Roles
Query
IdentityInfo
| where UserType == "Guest"
// Collect the most recent information for each Guest user
| summarize arg_max(TimeGenerated, *) by AccountUPN
// Only show Guests that have roles in your tentant
| where array_length(AssignedRoles) > 0
| project AccountUPN, AssignedRoles, IsAccountEnabledAbout this query
Guest user with AD roles
Query Information
Description
This query can be used to display all Guest users in the tenant who have Azure Active Directory roles. Guest users by default have different rights than normal users, at the time these Guest users get additional roles those permissions change. Therefore, the least privilege principle should be applied to Guest (and all other) users, so that these Guest users cannot access sensitive information.
Risk
A Guest user has High privliges and could perform more actions then needed.
References
- https://learn.microsoft.com/en-us/azure/active-directory/roles/permissions-reference
- https://learn.microsoft.com/en-us/azure/active-directory/external-identities/b2b-quickstart-add-guest-users-portal
- https://learn.microsoft.com/en-us/azure/role-based-access-control/role-assignments-external-users
Sentinel
Explanation
This query is designed to identify guest users within an Azure Active Directory (AD) tenant who have been assigned roles, which could potentially grant them higher privileges than necessary. Here's a simple breakdown of what the query does:
-
Filter for Guest Users: It starts by selecting users classified as "Guest" in the directory.
-
Get Latest Information: For each guest user, it retrieves the most recent data available.
-
Check for Assigned Roles: It then filters these users to find those who have been assigned one or more roles within the tenant.
-
Display Relevant Information: Finally, it displays the user's principal name (AccountUPN), the roles assigned to them, and whether their account is enabled.
The purpose of this query is to help administrators ensure that guest users do not have more access than necessary, adhering to the principle of least privilege to protect sensitive information.
Details
Bert-Jan Pals
Released: November 17, 2023
Tables
Keywords
Operators