title: Guest Users Invited To Tenant By Non Approved Inviters
id: 4ad97bf5-a514-41a4-abd3-4f3455ad4865
status: test
description: Detects guest users being invited to tenant by non-approved inviters
references:
- https://learn.microsoft.com/en-gb/entra/architecture/security-operations-user-accounts#monitoring-external-user-sign-ins
- https://learn.microsoft.com/en-us/entra/identity/monitoring-health/reference-audit-activities#invited-users
author: MikeDuddington, '@dudders1'
date: 2022-07-28
modified: 2026-05-09
tags:
- attack.privilege-escalation
- attack.persistence
- attack.initial-access
- attack.stealth
- attack.t1078
logsource:
product: azure
service: auditlogs
detection:
selection:
category: 'UserManagement'
operationName: 'Invite external user'
filter_main_unapproved_inviters:
properties.initiatedBy|contains|expand: '%Approved_Inviters%'
condition: selection and not 1 of filter_main_*
falsepositives:
- Unlikely
level: medium