---
title: Microsoft Entra B2B guest user has administrator-equivalent Azure RBAC rights
description: Datadog, the leading service for cloud-scale monitoring.
breadcrumbs: >-
  Docs > Datadog Security > OOTB Rules > Microsoft Entra B2B guest user has
  administrator-equivalent Azure RBAC rights
---

> For the complete documentation index, see [llms.txt](https://docs.datadoghq.com/llms.txt).

# Microsoft Entra B2B guest user has administrator-equivalent Azure RBAC rights

## Description{% #description %}

A Microsoft Entra B2B guest user has administrator-equivalent Azure RBAC rights at the tenant root, a management group, or a subscription. Guest accounts are typically used for external collaboration and may authenticate with identities managed outside your tenant. Compromise or mismanagement of a guest account could allow an attacker to control resources and security settings within that scope.

## Remediation{% #remediation %}

Review the guest user's access and remove Azure role assignments that grant unnecessary administrator-equivalent permissions. Remove guest accounts that no longer require access, and use access reviews to regularly validate continued access. For guidance, refer to [Remove Azure role assignments](https://learn.microsoft.com/en-us/azure/role-based-access-control/role-assignments-remove) and [Manage guest access with access reviews](https://learn.microsoft.com/en-us/entra/id-governance/manage-guest-access-with-access-reviews).