EXT-09: Guest User Lifecycle Review

EXT-09 is a security control that stale guest accounts are attack targets. unlike internal accounts, guest accounts may not be subject to your password policies or mfa requirements. regular lifecycle review prevents unauthorized access through forgotten guest identities. It requires that guest accounts inactive for 90+ days are identified and stale guests are disabled or removed, guest accounts that never signed in are reviewed.

Stale guest accounts are attack targets. Unlike internal accounts, guest accounts may not be subject to your password policies or MFA requirements. Regular lifecycle review prevents unauthorized access through forgotten guest identities.

TrueConfig provides one-click remediation for EXT-09. Can automatically disable guest accounts inactive for 90+ days

This control can be implemented with any Microsoft 365 subscription, including free Azure AD.

EXT-09 is included in the TrueConfig Recommended Secure baseline (Level 1). This is the foundation level suitable for most organizations.