id: azure-entra-id-guest-users-unmonitored
info:
  name: Azure Entra ID Guest Users Unmonitored
  author: princechaddha
  severity: medium
  description: |
    For a Microsoft Azure business-to-business (B2B) collaboration, each Microsoft Entra ID guest user needs to be associated with a business owner or business process. Ensure that there are no unassociated Microsoft Entra ID guest users within your Microsoft Azure account when there is no need for B2B collaboration.
  impact: |
    Presence of unmonitored Microsoft Entra ID guest users can lead to unauthorized access and potential security risks within the Azure environment.
  remediation: |
    Regularly review and monitor guest users in Microsoft Entra ID to ensure each is associated with a business owner or process. Remove any unnecessary guest user accounts.
  reference:
    - https://docs.microsoft.com/en-us/azure/active-directory/external-identities/
  tags: cloud,devops,azure,microsoft,entra-id,azure-cloud-config

self-contained: true
code:
  - engine:
      - sh
      - bash
    source: |
      az ad user list --query "[?userType=='Guest']" --output json

    matchers:
      - type: word
        words:
          - '"userType": "Guest"'

    extractors:
      - type: dsl
        dsl:
          - '"Azure Account han an Entra ID guest user Microsoft Entra ID"'
# digest: 4b0a00483046022100b8a6a0269e19e9c3dce2f5360a03d30194c43dd26f6bf43d773e9500d53ac14b022100bcfa41a6ed2015b08fbb6e732a1fff7b02870b00738c695664e8822ba263f1be:922c64590222798bb761d5b6d8e72950