SOP-23: Guest Account & External Collaboration Abuse Response

Rudra Verma, Senior Security Architect & Researcher · 2026-06-28

Azure AD B2B collaboration allows internal users to invite external identities as guests. Attackers exploit this in two directions: (1) a compromised internal account invites an attacker-controlled external email as a guest to establish persistent access that survives remediation of the internal account, and (2) guest accounts already present in the tenant are compromised or used beyond their intended scope — accessing sensitive sites, Teams channels, or SharePoint document libraries containing confidential data.

Entra ID fires AuditLogs on Invite external user and Add user operations for guest accounts. The sign-in type B2B distinguishes guest activity in SigninLogs for ongoing monitoring.

◈ Table of Contents

01 Background 02 Identification 03 Containment 04 Eradication 05 Escalation

Background

CONTEXT

B1Guest Abuse Scenarios & MITRE Mapping

Scenario	MITRE	Indicator
Compromised internal user invites attacker as guest	T1136.003	AuditLogs: Invite external user — attacker's personal/free email domain (gmail.com, proton.me, outlook.com)
Mass guest invitation for data exfiltration	T1537	Multiple invitations in short window; invited guest immediately accesses SharePoint/OneDrive
Existing guest accessing unauthorized resources	T1078.004	SigninLogs: B2B sign-in accessing apps outside the guest's authorized scope
Guest account elevation attempt	T1078.004	AuditLogs: Guest UPN (ending in #EXT#) added to privileged group or assigned a role
Stale guest dormant then suddenly active	T1078.004	No sign-in for 90+ days followed by active session — possible compromised invitation link still valid

B2Log Sources

Source	Table	Key Indicator
Entra ID Audit	AuditLogs	Invite external user, Add user (guest), Add member to group (guest UPN with #EXT#)
Entra ID Sign-in	SigninLogs	UserType == Guest; CrossTenantAccessType == B2BCollaboration; unusual app or resource
SharePoint / OneDrive	OfficeActivity	SharingSet, FileDownloaded, FileAccessed by external UPN
Teams	OfficeActivity	Guest access to Teams channels; MeetingParticipantDetail with external UPN

Identification

INVESTIGATE

Guest Account Abuse — Investigation Workflow

I1Detect Suspicious Guest Invitations & ActivityKQL + SPL

KQL — Sentinel: Guest invitations from non-approved domains (last 7 days)

// Detect guest invitations from free email providers or unknown domains let approved_domains = dynamic(["partnerco.com", "vendor.com"]); // adjust to your allowlist AuditLogs | where TimeGenerated > ago(7d) | where OperationName in ("Invite external user", "Add user") | extend GuestEmail = tostring(TargetResources[0].userPrincipalName) | extend InvitedBy = tostring(InitiatedBy.user.userPrincipalName) | extend GuestDomain = tostring(split(GuestEmail,"@")[1]) // Flag free email domains and non-approved orgs | where GuestDomain in~ ("gmail.com","outlook.com","hotmail.com","proton.me","yahoo.com") or not(GuestDomain in~ (approved_domains)) | project TimeGenerated, OperationName, GuestEmail, GuestDomain, InvitedBy | order by TimeGenerated desc

KQL — Guest sign-ins accessing sensitive resources

// Monitor B2B guest sign-ins — filter by sensitive app access SigninLogs | where TimeGenerated > ago(7d) | where UserType == "Guest" // Flag access to sensitive apps | where AppDisplayName in~ ( "Azure Portal","Azure Active Directory","SharePoint Online", "Microsoft Teams","OneDrive","Microsoft 365 compliance center" ) | extend GuestUPN = UserPrincipalName | extend HomeTenant = tostring(HomeTenantId) | project TimeGenerated, GuestUPN, AppDisplayName, IPAddress, Location, HomeTenant | order by TimeGenerated desc

SPL — Splunk: External user invitation detection

index=azure sourcetype=azure:aad:audit OperationName="Invite external user" | spath InitiatedBy.user.userPrincipalName OUTPUT InvitedBy | spath TargetResources{}.userPrincipalName OUTPUT GuestUPN | eval domain=mvindex(split(GuestUPN,"@"),1) | where domain IN ("gmail.com","outlook.com","hotmail.com","proton.me") | table _time, GuestUPN, domain, InvitedBy | sort -_time

Guest accounts inherit the MFA policy of the inviting tenant only if they were invited via B2B direct connect and the home tenant's MFA is trusted. For B2B collaboration (standard guest invitations), the guest authenticates against their home tenant — your MFA requirements may not apply unless Entra ID External Identities MFA trust settings are correctly configured.

I2Audit Guest Resource AccessKQL

KQL — SharePoint/OneDrive files accessed by specific guest

let guest_upn = "attacker_gmail.com#EXT#@yourtenant.onmicrosoft.com"; OfficeActivity | where TimeGenerated > ago(7d) | where UserId =~ guest_upn | where Operation in ("FileDownloaded","FileAccessed","FileSyncDownloadedFull","SharingSet") | project TimeGenerated, Operation, OfficeWorkload, SourceFileName, SiteUrl | order by TimeGenerated asc

Stale guest accounts (no sign-in for 90+ days) are a persistent attack surface — invitation links can remain valid indefinitely if not explicitly blocked. Run a monthly access review in Entra ID → Identity Governance → Access Reviews targeting guest accounts to automatically remove inactive guests.

Containment

STOP IT

C1Delete Guest Account & Revoke AccessImmediate

1
Block sign-in for the guest account: Entra ID → Users → [Guest UPN] → Account enabled → NO. This immediately prevents any further sign-in without deleting the object (preserving audit trail).
2
Revoke all shared links and SharePoint permissions: SharePoint admin center → [affected site] → Site permissions → remove the guest. Also revoke any anonymous sharing links created during the guest's session.
3
Remove from all groups and Teams: Entra ID → Users → [Guest] → Groups → remove all memberships. Teams admin center → remove guest from all Teams.
4
Block inviting user's account if they are confirmed compromised (see SOP-18 for session revocation steps).
5
Delete the guest account after audit trail is captured: Entra ID → Users → Delete. The account moves to the deleted users recycle bin for 30 days.

Eradication

CLEAN UP

E1Guest Inventory Audit & B2B Hardening

1
Run a full guest account inventory: Entra ID → Users → Filter by User type: Guest. Audit all guests — confirm each has a documented business justification, a sponsoring internal user, and a defined expiry date.
2
Enable guest access restrictions: Entra ID → External Identities → External collaboration settings → set Guest user access to "Most Restricted" (guests can only see their own directory objects) if your business model allows it.
3
Enable Entra ID Access Reviews for guest accounts on a 90-day cycle: Identity Governance → Access Reviews → New review targeting all guest users — auto-remove inactive guests on review expiry.
4
Restrict who can invite guests: External collaboration settings → Guest invite settings → "Only users assigned to specific admin roles can invite guest users" — prevents any internal user from self-serving guest invitations.
5
Restrict SharePoint external sharing: SharePoint admin center → Policies → Sharing → set to "Existing guests" or "Only people in your organization" depending on business requirements.

Eradication Complete When

Malicious guest account deleted; all shared permissions revoked
Full guest inventory reviewed — all guests have documented sponsors
Guest invite permissions restricted to admin roles only
Access review policy configured for 90-day auto-review of all guests
Data accessed by guest documented; breach assessment complete

Escalation

TIERS

ESC1Escalation Tiers

Tier	Trigger	Action
L1 → L2	Unauthorized guest from free email domain; invite accepted but no sensitive resources accessed; inviting user not confirmed compromised	Delete guest, block invite, educate inviting user. Escalate for inviting user's account review.
L2 → IR + CISO	Guest accessed SharePoint, downloaded files, or accessed Azure portal; inviting user confirmed compromised (AiTM); guest added to privileged groups	Data breach assessment. Review all resources the guest touched. CISO notification. Legal assessment if confidential data accessed.
IR → Security Engineering	Guest invite restrictions were not enforced (any user could invite); multiple guests invited across multiple compromised accounts; systematic exfiltration via SharePoint sync	Emergency enforcement of guest invite restrictions and SharePoint external sharing lockdown. Access review for all active guests.

Authorized security research & penetration testing only. Unauthorized use is illegal. Authored by Rudra Verma | Senior Security Architect | CyberHawk Consultancy.

◈ Stay Connected

Follow CyberHawk Threat Intel for SOC SOPs, threat intelligence, and hands-on analyst tooling.

Website YouTube Twitter / X TikTok Telegram

All SOPs Blog Courses

"They can't exploit you if you are the Exploit."