> ## Documentation Index
> Fetch the complete documentation index at: https://cloudanix.com/docs/llms.txt
> Use this file to discover all available pages before exploring further.

# Guest Users In Use

### More Info:

Avoid creating guest users, as they are typically added outside your employee on-boarding/off-boarding process and could potentially be overlooked indefinitely leading to a potential vulnerability.

### Risk Level

Medium

### Address

Security

### Compliance Standards

HITRUST, SOC2, NISTCSF, PCIDSS

### Triage and Remediation

<Tabs>
  <Tab title="Remediation">
    ### Remediation

    <AccordionGroup>
      <Accordion title="Using Console" defaultOpen="true">
        The presence of guest users in an Azure Active Directory (AD) can pose a security risk. Here are the steps to remediate the issue of guest users in use in Azure:

        1. Sign in to the Azure portal using your administrator credentials.
        2. In the left-hand menu, click on "Azure Active Directory".
        3. Under "Manage", select "Users".
        4. On the "Users" page, click on the "Guest users" tab.
        5. Review the list of guest users to determine which ones need to be removed.
        6. Select the guest user that you want to remove by clicking on the checkbox next to their name.
        7. Click on the "Remove" button at the top of the screen.
        8. Confirm that you want to remove the guest user by clicking "Yes" in the confirmation dialog box.

        Repeat steps 6-8 for each guest user that you want to remove.

        Note: Before removing a guest user, make sure that they no longer require access to any resources in your Azure environment.

        #
      </Accordion>

      <Accordion title="Using CLI">
        The "Guest Users in Use" misconfiguration in Azure refers to the presence of external users who have access to your Azure Active Directory tenant. To remediate this misconfiguration, you can follow the below steps using Azure CLI:

        1. Run the following command to list all the external/guest users in your Azure Active Directory tenant:

           ```
           az ad user list --query "[?userType=='Guest']"
           ```

        2. Identify the guest users that should not have access to your Azure resources.

        3. Run the following command to remove a guest user:

           ```
           az ad user delete --id <guest-user-object-id>
           ```

           Replace `<guest-user-object-id>` with the object ID of the guest user you want to remove.

        4. Repeat step 3 for all the guest users that should not have access to your Azure resources.

        5. After removing the guest users, you can also disable external sharing for your Azure Active Directory tenant by running the following command:

           ```
           az ad domaingroup update --id <object-id-of-the-external-users-group> --set "securityEnabled=true"
           ```

           Replace `<object-id-of-the-external-users-group>` with the object ID of the group that contains all the external users in your Azure Active Directory tenant.

        By following these steps, you can remediate the "Guest Users in Use" misconfiguration in Azure using Azure CLI.
      </Accordion>

      <Accordion title="Using Python">
        The misconfiguration "Guest Users In Use" occurs when guest users are granted access to Azure resources. To remediate this issue, we can use the Azure Python SDK to write a script that will identify the guest users and remove their access.

        Here are the steps to remediate "Guest Users In Use" for Azure using Python:

        1. Install the Azure Python SDK by running the command `pip install azure-mgmt-resource`.

        2. Authenticate with Azure using your Azure account credentials. You can do this by using the `ServicePrincipalCredentials` class from the Azure Python SDK. Here's an example:

        ```python theme={null}
        from azure.common.credentials import ServicePrincipalCredentials

        TENANT_ID = '<your tenant id>'
        CLIENT_ID = '<your client id>'
        CLIENT_SECRET = '<your client secret>'

        credentials = ServicePrincipalCredentials(
            client_id=CLIENT_ID,
            secret=CLIENT_SECRET,
            tenant=TENANT_ID
        )
        ```

        3. Use the Azure Python SDK to list all the guest users in your Azure AD tenant. You can do this by using the `GraphRbacManagementClient` class from the Azure Python SDK. Here's an example:

        ```python theme={null}
        from azure.graphrbac import GraphRbacManagementClient
        from azure.graphrbac.models import UserFilter

        graph_client = GraphRbacManagementClient(credentials, TENANT_ID)

        guest_users = graph_client.users.list(filter="userType eq 'Guest'")
        for guest_user in guest_users:
            print(guest_user.userPrincipalName)
        ```

        4. Use the Azure Python SDK to remove the guest users' access to Azure resources. You can do this by using the `RoleAssignmentsOperations` class from the Azure Python SDK. Here's an example:

        ```python theme={null}
        from azure.mgmt.authorization import AuthorizationManagementClient

        authorization_client = AuthorizationManagementClient(credentials, subscription_id)

        for guest_user in guest_users:
            role_assignments = authorization_client.role_assignments.list_for_principal(
                guest_user.object_id,
                filter="atScope()",
                expand="roleDefinition"
            )
            for role_assignment in role_assignments:
                authorization_client.role_assignments.delete(
                    role_assignment.scope,
                    role_assignment.name
                )
        ```

        This script will remove the guest users' access to all Azure resources in your subscription. You can schedule this script to run periodically to ensure that guest users do not have access to your Azure resources.
      </Accordion>
    </AccordionGroup>
  </Tab>
</Tabs>