Posture check · Entra ID and hybrid
Every external tenant's sign-in claims are trusted (T1199)
The default cross-tenant access settings accept multifactor or device claims from any Microsoft Entra tenant. This tenant then trusts how every other tenant signs in its users.
Why it matters
A hostile or compromised tenant can issue sign-ins that satisfy your Conditional Access requirements.
How GraphnAI finds it
It runs after every sync, on each connected domain or tenant on its own. It applies to Microsoft Entra ID.
It reads:
- 2 more GraphnAI analyses
Why there's no automatic fix
GraphnAI doesn't change cross-tenant access settings yet.
How to fix it
In the Microsoft Entra admin center, open External Identities, then Cross-tenant access settings. On the Default settings tab, turn off Trust multifactor authentication from Microsoft Entra tenants, Trust compliant devices and Trust Microsoft Entra hybrid joined devices. Trust specific partners instead.
Related checks
MITRE ATT&CK® technique names and MITRE D3FEND™ technique labels: © The MITRE Corporation. This work is reproduced and distributed with the permission of The MITRE Corporation. ATT&CK® is a registered trademark and D3FEND™ a trademark of The MITRE Corporation.
See it on your own directory.
The Public Preview is free for 30 days from your first sync, on your own server.