Guest Users in Admin Groups

What this means

One or more guest (external) users have been assigned to administrative roles or role-assignable groups in your tenant. Guest users are identities managed by another organisation.

Why is it a security risk?

• You do not control the security posture of the guest's home tenant — their MFA, password policies, and conditional access are outside your jurisdiction.
• If the guest's home account is compromised, the attacker inherits administrative privileges in your tenant.
• This is flagged as Critical because admin-level access combined with external identity is the highest-risk combination.

Recommended next steps

1. Go to Microsoft Entra admin center → Roles and administrators and check each admin role for guest members.
2. For each guest admin, determine if there is a business justification. In most cases, the guest should be removed from the admin role.
3. If external admin access is genuinely needed, create a dedicated cloud-only account in your tenant instead of using a guest invitation.
4. Apply Conditional Access policies targeting guest users to enforce MFA and restrict sign-in locations.