Posture check · Entra ID and hybrid
Unapproved partner tenant's sign-in claims are trusted (T1199)
A partner tenant that isn't on the approved list is trusted for multifactor or device claims, or redeems invitations automatically.
Why it matters
That tenant's admins, or an attacker who controls it, can sign users in as if they had passed your own checks.
How GraphnAI finds it
It runs after every sync, on each connected domain or tenant on its own. It applies to Microsoft Entra ID.
It reads:
- 3 more GraphnAI analyses
Why there's no automatic fix
GraphnAI doesn't change cross-tenant access settings yet.
How to fix it
In the Microsoft Entra admin center, open Cross-tenant access settings and turn off the trust settings you don't need for each flagged partner. If you trust the partner, add its tenant ID to this tenant's approved partner tenants in GraphnAI.
Related checks
MITRE ATT&CK® technique names and MITRE D3FEND™ technique labels: © The MITRE Corporation. This work is reproduced and distributed with the permission of The MITRE Corporation. ATT&CK® is a registered trademark and D3FEND™ a trademark of The MITRE Corporation.
See it on your own directory.
The Public Preview is free for 30 days from your first sync, on your own server.