Verify Guest Conditional with airSlate SignNow

Add guest conditional

hey everyone in this pretty quick video i want to quickly explore azure 80 guest user permissions as always if this video is useful please give it a like subscribe comment and share so the idea is i have my azure active directory so i have my azure ad tenant and i've populated that with all my users my groups generally replicated from an ad on premises but i could have cloud accounts as well and then to this azure id i have lots of kind of apps that are federated through those identities and might have azure services but there's other people i work with there might be partners that have their own azure ad over here there might be microsoft accounts there might be gmail accounts i might use regular kind of saml federation i might even use thing with a one-time passcode i'll email them a code and then they type that in to actually authenticate and for all of these things essentially what i'm doing is i'm making these aware using b to b so all of these identities these are external these are all external sources so my source for the object that gets created so for all of these when i add a b to b it creates like a little stub object here but it is an external for the source additionally there's another attribute there's something called a user type and this is going to be guest now we often think they're one and the same thing hey if you're external if you're b2b you're a guest and that's true initially but technically they don't have to be i can with powershell for example set azure ad user i could change the user type to be member so member is what we often see for people that are actually part of our azure ad tenant they have replicated from aed they were created as cloud accounts and why this is important is we want to collaborate with these people and most of the time we want those external sources and we can see this so if i quickly jump over to the portal for a second here in the portal we can see hey i have users if i go and look at all my users you can see hey did they come from for example the directory synchronization that came from ad and i can see hey the user type are they members or are they guests and you see most of them are members but i do have a couple of guests i've got one here that's obviously ext it's an external source yahoo if i go and look at that well it will actually show me here the source well in this case it's otp one-time passcode because there is no kind of federation capability with yahoo however if i went and looked for example at my gmail account instead we can see here well the source is google right here it's showing us that source we can also see the user type here is guest but i have other users i have ones that for example are just microsoft accounts but that microsoft account i can see hey yeah look the source is microsoft but it's a member i have other accounts that come from a completely different azure ad so you can see this is an external azure active directory but it's a type member the reason i might change that would be something like hey i've got this relationship with another company maybe it's an acquisition maybe we've merged together so i've added their accounts into my azure id as an external source but they're not really guests they are part of my organization and i want them to be treated as members so i can change the type but ordinarily you're going to keep them as guests now that guest is used in many different things conditional access has an option around guests access reviews to check should i keep access to this group or app or this role can trigger on guess even dynamic groups i have an option for will the user type is guest so there's many types of checks we can do around guest users so it's important to understand hey there is this differentiation and often we treat those external people as a guest but there's another area and that's really the thing i wanted to focus on here and it's really about what they can do to azure ad itself and what they can see because there's really three different settings i have and what the default setting does is if i'm a guest i can see my account and if i i can't browse i can't just go and look at everything in azure id but if i know the upn if i know the id i can look at the object and i could look at who the manager is who reports to what groups they're in and then because now i know the group name what's the membership of that group well now i know the people well i can look at that person and i can basically track the entire hierarchy of the organization i could guess at upns if i know the naming scheme for the company i can't browse but if i can guess the upn i can then go and look at the object so that ability to kind of peruse through and map out and work out is scary for some companies so there's now a restricted option that says i can look at my object and that's it i can't even if i know the upn i can't look at membership groups i can't look at other objects i can't do any of that stuff and that's actually what i'm going to focus on so if we jump over for a second now the way i'm going to get to this if i go back to my azure id and if i go down here i have this user settings option right here on the left so i'm going to go ahead and select user settings and then i have this external users set of options so i'm going to say manage external collaboration settings now this opens up a lot of different things you'll see there's a whole bunch of settings here around guest user invites who can invite guests can guest invite guests to enable this one-time passcode when that guest is part of an organization that's not gmail it's not a microsoft account it's not azure id it doesn't support saml and i want to just send them a one-time passcode that proves they still have access to a mailbox so it kind of proves they're still at that other place want guest self sign up but i'm going to focus on these options up here and what this is showing is hey look the default guests have limited access to properties and memberships but essentially as i kind of talked about what that means is hey if i can guess the upn if i can look at some option i can find my way around the entire azure id i could make guests behave exactly the same as regular users now i could browse i can actually just say hey show me the azure id i can see everything generally you're not going to do that but now i have this other option user access is restricted to properties and memberships of their directory objects now even if i know the upn i cannot go and look that object i cannot look at membership of groups i can completely lock it down now things like sharepoint and teams will still work they have their own sets of controls other applications you're going to want to test and really make sure it's not breaking them there's actually a microsoft article that talks through all these different levels of permissions to member user permissions default guest permissions and restricted and as you can kind of see it walks through to say hey normally i could read properties read display names and contacts and search by properties if i do this restricted mode over here i really can't do anything i can read my properties and that's it i have no permissions to groups i can read properties of enterprise apps i can read company display name but really where the big difference is are these users and contacts and the groups essentially i can read my own and that's it so if you are concerned about the idea that someone as a guest you have guests in your azure id and you're worried about them mapping out your azure id you're seeing things hey if i can go and see group memberships i go and see a group called special project i can see who's working in that maybe i can work things out if that's a concern for you then by all means look at this new restricted option make sure you test the apps especially doesn't break things you can go ahead and help lock that things down so again it's just a setting now in azure id um check it out a test tenant first test test test um but there you go i hope this was useful until next time take care you