Ensure that collaboration invitations are sent to allowed domains only

Why This Matter

Unrestricted collaboration invitations can expose your organization to significant security risks. Without domain restrictions, internal users may inadvertently grant external users such as personal email accounts access to sensitive company resources. This creates an uncontrolled attack surface where unauthorized individuals can gain entry to your tenant.

What Aether365 Checks

Aether365 verifies that your Microsoft Entra ID tenant restricts B2B collaboration invitations to only allowed domains. This check appears in the Aether365 dashboard under entra-id checks and confirms that the "Allow invitations only to the specified domains" option is enabled with a defined list of trusted domains.

How to Fix

Complete the following steps to configure allowed domains for collaboration invitations.

Microsoft references

• Users default permissions
• Active directory assign admin roles azure portal
• Security controls v2 governance strategy
• Security controls v2 governance strategy
• Security controls v2 privileged access
• Security controls v2 privileged access