Restrict guest access permissions in Microsoft Entra ID

Microsoft Entra ID, part of Microsoft Entra, allows you to restrict what external guest users can see in their organization in Microsoft Entra ID. Guest users are set to a limited permission level by default in Microsoft Entra ID, while the default for member users is the full set of user permissions. There's another guest user permission level in your Microsoft Entra organization's external collaboration settings for even more restricted access, so that the guest access levels are:

When guest access is restricted, guests can view only their own user profile. Permission to view other users isn't allowed even if the guest is searching by User Principal Name or objectId. Restricted access also restricts guest users from seeing the membership of groups they're in. For more information about the overall default user permissions, including guest user permissions, see What are the default user permissions in Microsoft Entra ID?.

Update in the Microsoft Entra admin center

We’ve made changes to the existing Azure portal controls for guest user permissions.

1. Sign in to the Microsoft Entra admin center as a User administrator.

2. Select Identity > External Identities.

3. Select External collaboration settings.

4. On the External collaboration settings page, select Guest user access is restricted to properties and memberships of their own directory objects option.

   

5. Select Save. The changes can take up to 15 minutes to take effect for guest users.

Update with the Microsoft Graph API

There is a new Microsoft Graph API to configure guest permissions in your Microsoft Entra organization. The following API calls can be made to assign any permission level. The value for guestUserRoleId used here is to illustrate the most restricted guest user setting. For more information about using the Microsoft Graph to set guest permissions, see authorizationPolicy resource type.

Configuring for the first time

POST https://graph.microsoft.com/beta/policies/authorizationPolicy/authorizationPolicy

{
  "guestUserRoleId": "2af84b1e-32c8-42b7-82bc-daa82404023b"
}

Response should be Success 204.

Updating the existing value

PATCH https://graph.microsoft.com/beta/policies/authorizationPolicy/authorizationPolicy

{
  "guestUserRoleId": "2af84b1e-32c8-42b7-82bc-daa82404023b"
}

Response should be Success 204.

View the current value

GET https://graph.microsoft.com/beta/policies/authorizationPolicy/authorizationPolicy

Example response:

{
    "@odata.context": "https://graph.microsoft.com/beta/$metadata#policies/authorizationPolicy/$entity",
    "id": "authorizationPolicy",
    "displayName": "Authorization Policy",
    "description": "Used to manage authorization related settings across the company.",
    "enabledPreviewFeatures": [],
    "guestUserRoleId": "10dae51f-b6af-4016-8d66-8c2a99b929b3",
    "permissionGrantPolicyIdsAssignedToDefaultUserRole": [
        "user-default-legacy"
    ]
}

Update with PowerShell cmdlets

With this feature, we've added the ability to configure the restricted permissions via PowerShell v2 cmdlets. Get and Update PowerShell cmdlets have been published in version 2.0.2.85.

Get command: Get-MgPolicyAuthorizationPolicy

Example:

Get-MgPolicyAuthorizationPolicy | Format-List

AllowEmailVerifiedUsersToJoinOrganization : True
AllowInvitesFrom                          : everyone
AllowUserConsentForRiskyApps              :
AllowedToSignUpEmailBasedSubscriptions    : True
AllowedToUseSspr                          : True
BlockMsolPowerShell                       : False
DefaultUserRolePermissions                : Microsoft.Graph.PowerShell.Models.MicrosoftGraphDefaultUserRolePermissions
DeletedDateTime                           :
Description                               : Used to manage authorization related settings across the company.
DisplayName                               : Authorization Policy
GuestUserRoleId                           : 10dae51f-b6af-4016-8d66-8c2a99b929b3
Id                                        : authorizationPolicy
AdditionalProperties                      : {[@odata.context, https://graph.microsoft.com/v1.0/$metadata#policies/authorizationPolicy/$entity]}

Update command: Update-MgPolicyAuthorizationPolicy

Example:

Update-MgPolicyAuthorizationPolicy -GuestUserRoleId '2af84b1e-32c8-42b7-82bc-daa82404023b'

Supported Microsoft 365 services

Supported services

By supported we mean that the experience is as expected; specifically, that it's same as current guest experience.

• Teams
• Outlook (OWA)
• SharePoint
• Planner in Teams
• Planner mobile app
• Planner web app
• Project for the web
• Project Operations

Services currently not supported

Service without current support might have compatibility issues with the new guest restriction setting.

• Forms
• Project Online
• Yammer
• Planner in SharePoint

Frequently asked questions (FAQ)

Next steps

• To learn more about existing guest permissions in Microsoft Entra ID, see What are the default user permissions in Microsoft Entra ID?
• To see the Microsoft Graph API methods for restricting guest access, see authorizationPolicy resource type
• To revoke all access for a user, see Revoke user access in Microsoft Entra ID