Posture check · Entra ID and hybrid
Unapproved tenant can sync users into this tenant (T1199, T1136.003)
A partner tenant that isn't on the approved list is allowed to sync users into this tenant.
Why it matters
An attacker who controls that tenant can create accounts here that look like ordinary members.
How GraphnAI finds it
It runs after every sync, on each connected domain or tenant on its own. It applies to Microsoft Entra ID.
It reads:
- 3 more GraphnAI analyses
Why there's no automatic fix
GraphnAI doesn't change cross-tenant access settings yet.
How to fix it
In the Microsoft Entra admin center, open Cross-tenant access settings, open each flagged partner and turn off Allow users to sync into this tenant. If you trust the partner, add its tenant ID to this tenant's approved partner tenants in GraphnAI.
Related checks
MITRE ATT&CK® technique names and MITRE D3FEND™ technique labels: © The MITRE Corporation. This work is reproduced and distributed with the permission of The MITRE Corporation. ATT&CK® is a registered trademark and D3FEND™ a trademark of The MITRE Corporation.
See it on your own directory.
The Public Preview is free for 30 days from your first sync, on your own server.