What this check looks at
Checks for a dynamic group whose rule picks every guest account, so policies and reviews can target guests as they come and go.
A dynamic group in Entra ID works out its own members from a rule on user properties, and updates as accounts are added and removed. A dynamic security group with the rule (user.userType -eq "Guest") always holds every guest account in the tenant. Dynamic membership needs Microsoft Entra ID P1, and no such group exists by default.
For tenants with Entra ID P1, the check passes when a dynamic group with a guest rule exists and its processing is on. It warns when the group exists but processing is paused, so new guests are not added, and fails when there is no such group.
Guests arrive through Teams, SharePoint sharing and invitations sent by many different people. Policies meant for guests (Conditional Access, access reviews, sharing restrictions) can only reach them all if something holds them all. Without a dynamic group, someone has to remember to add every new guest to a static group, and the ones they miss get none of the guest controls.
Why it matters
Guests are added by many people over time. A group that holds every guest automatically is what lets Conditional Access, access reviews and sharing policies apply to all of them, not just the ones someone remembered to add.
Suppose the client wants guests to use MFA every time and to be reviewed regularly. The policies are built on a hand-maintained group of guests that was accurate the day it was made. A year later, forty guests have been added through Teams and none is in the group: they sign in without the guest MFA policy and are never reviewed, including a consultant whose own company has since been breached.
A dynamic group takes minutes to create and nothing to maintain, and every later guest control then works on the real population of guests rather than an out-of-date list.
The CIS Microsoft 365 Foundations Benchmark (5.1.3.1) asks for a dynamic group for guest users. The rule maps to NIST CSF 2.0 PR.AA-01.
How to fix it
Where: Entra admin centre → Groups → All groups
Before you start
- Needs Entra ID P1 for dynamic membership. Choose a clear name, such as "All guests (dynamic)", so it is not mistaken for a manual group.
Step by step
- Check for an existing group. In the Microsoft Entra admin centre, go to Entra ID > Groups > All groups and filter on Membership type Dynamic. If a guest group already exists but its processing is paused, go to the step about resuming processing.
- Create the group. Select New group. Group type: Security. Group name: "All guests (dynamic)", with a description saying it is maintained automatically. Membership type: Dynamic User. Add an owner from IT.
- Add the membership rule. Select Add dynamic query, then Edit beside the rule syntax box and enter (user.userType -eq "Guest"). Use Validate Rules to check that a known guest is included and a member is not. Save the rule, then select Create.
- Resume processing if it is paused. For an existing guest group whose processing is paused, resume it in Microsoft Graph PowerShell: Connect-MgGraph -Scopes Group.ReadWrite.All, then Update-MgGroup -GroupId <group id> -MembershipRuleProcessingState On.
- Check the membership. Processing takes a few minutes, longer in a large tenant. Then compare the group’s member count with Entra ID > Users filtered on User type Guest; the two should match.
- Use the group for guest controls. Use the group wherever a control should cover every guest: a Conditional Access policy for guests, an access review, or a sharing policy. That is beyond this check, but it is why the group exists.
- Confirm. The group shows Membership type Dynamic User with the rule (user.userType -eq "Guest") and processing on. Re-run the assessment to confirm.
What users will notice
None. The group fills itself as guests are added and removed.
How to confirm it worked
Entra admin centre, Groups: the group shows Membership type Dynamic User with the rule (user.userType -eq "Guest"), and its member count matches the number of guests.
Frameworks and controls
This check maps to controls in 13 frameworks. Passing it is evidence that the setting is in place, not a certification against any of them.
| Framework | Control |
|---|---|
| NCSC CAF | B2.d Identity and access management (IdAM) |
| DSPT | Standard 4: Managing data access |
| NIS2 | Art. 21(2)(i) Access control and asset management |
| Microsoft Cloud Security Benchmark | PA-4 Review and reconcile user access regularly |
| Zero Trust | Identities |
| SOC 2 | CC6.2 User registration, authorisation and removal |
| NIST SP 800-171 | 3.1.1 Limit system access to authorised users, processes and devices |
| CMMC Level 2 | AC.L2-3.1.1 Authorized Access Control |
| ISO 27001:2022 | A.5.16 Identity managementA.5.18 Access rights |
| CIS M365 | 5.1.3.1 Ensure a dynamic group for guest users is created |
| CIS Controls v8.1 | 5.1 Establish and maintain an inventory of accounts (IG1) |
| NIST CSF 2.0 | PR.AA-01: Identities and credentials for authorized users, services, and hardware are managed by the organization |
| NCSC 10 Steps | Identity and access management |
The framework mappings were last checked against the published standards in October 2026.
Microsoft’s documentation
- Dynamic membership rules for groups (Microsoft Learn)