Boundary Escape: Hybrid Identity Attack Paths Across Forests and Tenants

Overview

Boundary Escape lists hybrid identity attack paths: identities in one security boundary that can reach objects in another. A boundary is an Active Directory forest or an Entra ID tenant. An identity escapes when an attack path from it crosses into a boundary other than its own. The classic case is an on-premises account that pivots through Entra Connect into the cloud. Another is a weak cross-forest trust. A tool that looks at one forest or one tenant at a time can't see these paths.

The page shows one row per identity. Each row names the identity's own boundary, the boundaries it escapes into, and how many objects it reaches in each. You can open any row to see the attack path, the reason for its route and its fidelity. Operators can then accept the risk with a written justification.

What carries an escape

An escape crosses a boundary over a carrier, an edge type that joins two boundaries. The flyout lists the carriers an identity uses:

Carrier (as the page names it)	What it does
Sync link	The hybrid link between an on-premises account and its Entra ID twin. It's real when password hash sync, pass-through authentication or SSO is in use.
Trust escalation	A weak cross-forest trust that lets an attacker who controls one forest escalate into the forest that trusts it. See Domain Trusts.

The sort order ranks carriers by severity. A trust escalation ranks above a sync link, whatever the object counts. The count only breaks a tie between identities with the same carrier. A cross-forest escalation therefore never sits below a single-account sync pivot.

Escapes aren't added into one total. An identity that escapes into two boundaries appears once, with a badge for each.

Prerequisites

Role: Operator or Admin. The Boundary Escape link sits under the Exposure group in the sidebar for Operators and Admins only. A Viewer who opens the URL sees "Boundary escapes need Operator access" and "Ask an Admin to change your role." A Viewer can still see the escape counts on the Graph Explorer boundary map.
Data: At least two connected boundaries, or one forest with a cross-forest trust. With one boundary and no carriers, the page is empty.
A finished analysis: The list appears after an analysis run finishes. Until then the page shows "Boundary escapes aren't ready yet" and "They appear after the next analysis run finishes." This isn't an error. Wait for the next sync and analysis.
Operational license: If your license is read-only, Accept the risk is disabled and shows the license lock.

Step-by-Step

View the identities that can escape

Select Boundary Escape in the sidebar.
Stay on the Active escapes tab.
Read the table. It sorts by Escapes into, most severe carrier first.
Select a column header to sort by it. Select it again to reverse the order.

To export the table, use the export control in the table's top right corner. The file is named graphnai-boundary-escape and has the Identity, Source boundary and Route columns.

Filter the list

The toolbar above the table has these controls:

Control	What it does
Source boundary	Keeps identities whose own boundary you pick. The default is All source boundaries. It appears when the list has more than one source boundary.
Escapes into	Keeps identities that escape into the boundary you pick. The default is Any boundary. It appears when the list has more than one target.
Route	All routes, Investigate, Select Fire or Accept.
Search identities	Matches part of the identity's name or ID.

With filters set and no matches, the table shows "No escapes match these filters" and "Clear a filter to see more." With no filters and no rows, it shows "No boundary escapes" and "No identity reaches beyond its own security boundary."

The Source boundary and Escapes into choices are in the page address. To share a filtered view, copy the address.

Open the list from the boundary map

Open Graph Explorer with no identity in focus.
Select the frame of an expanded boundary to open its panel.
In the Escapes section, select View escapes beside a peer boundary.

The page opens filtered to that pair. It lists the same identities the panel counted. See Graph Explorer.

Investigate an escape

Select a row. The page splits into the table, a blast radius graph of the identity and a detail flyout.
Read the Escapes into section of the flyout. It lists each target boundary with the number of objects reached, then a badge for each carrier.
Read Why this route. It gives one sentence on why the escape went to its route, then the Route, Fidelity, Behavior and Operational Safety Metric™ values.
Select a bucket on the graph to open the identities behind it in a drill-down table. Select an edge in that table to see it in the flyout. See Relationship Detail Drill-Down.
Select Open in Graph Explorer to inspect the identity there.

If the edge is one you can remove, the edge view offers Select Fire™ to simulate and remove it. See Select Fire. A sync link or a trust is part of how your hybrid environment works, so check what depends on it before you remove it.

Accept the risk

Accept an escape when it's by design, such as an Entra Connect account that hybrid sign-in needs.

Select the row, then select Accept the risk in the flyout footer.
Enter a Justification (required). For example: "Entra Connect password hash sync, needed for hybrid sign-in".
Optionally set Review again (optional) to Every 90 days, Every 180 days or Every 365 days. The default is Don't schedule a review.
Select Accept the risk.

GraphnAI records who accepted it and when, takes the escape off Active escapes and opens Accepted risks.

An escape that reaches a Critical target or a Tier 0 target needs an Admin to accept it. An Operator who tries sees "Only an Admin can accept a high-criticality escape. Ask an Admin to accept it."

An accepted escape comes back to Active escapes when any of these happens:

It reaches a new boundary or a different set of carrier edges.
A target becomes more critical.
Its review date passes.

Review and revoke accepted risks

Select the Accepted risks tab.
Read the register. Select Revoke on a row, then Revoke again in the "Revoke acceptance?" dialog.

The escape returns to Active escapes. If a banner says the list stopped loading early, treat the register as incomplete.

What the Columns and Fields Mean

Active escapes

Column	Meaning
Identity	The identity that can escape.
Source boundary	The identity's own forest or tenant, shown by name.
Escapes into	The boundaries outside its own that the identity reaches, each as a badge with the number of objects reached there.
Fidelity	How well the crossing is evidenced. See Tiered Fidelity™ of an escape.
Route	Where the escape goes next. See Routes.

Accepted risks

Column	Meaning
Accepted by	Who accepted the escape.
Escapes into	The boundary the escape reached.
Justification	The reason entered at acceptance.
At acceptance	The Fidelity, and the most critical target the escape reached, when it was accepted.
Accepted	How long ago.

Field	Values
Behavior	Matches its baseline, Unusual for this identity or Not yet observed.
Operational Safety Metric™	Not yet observed today. GraphnAI doesn't score a crossing yet.

Tiered Fidelity™ of an escape

Fidelity says how well a crossing is evidenced. The levels are Theoretical, Constrained and Validated. A Validated crossing is one where telemetry saw that step itself in use.

Today every escape shows Theoretical. GraphnAI builds each crossing from the graph. It doesn't yet collect sign-in evidence for a step across two boundaries. An escape you see here is a path that exists in your configuration. It doesn't show that anyone has used it.

Routes

Route	Meaning
Investigate	A person needs to look at it. Every escape has this route today, because the page can't collect sign-in evidence for a crossing yet.
Select Fire	Activity across the boundary doesn't match the identity's usual behavior.
Accept	Recorded sign-ins confirm the crossing and match usual behavior, and GraphnAI recommends accepting it.

The flyout's Why this route sentence gives the reason. A route of Select Fire or Accept appears only when GraphnAI has cross-boundary evidence. Until then, expect Investigate.

Configuration

Boundary Escape has no settings of its own. The list depends on these:

Boundaries: Each connected forest or tenant is a boundary. See Graph Explorer.
Analysis: The list refreshes after every analysis run that follows a sync. Until a connector reports its boundary, its identities are held apart and aren't assessed for escapes.

Limits

Reach counts objects of every type. The Escapes into number counts all objects the identity reaches in the target boundary. It isn't limited to Tier 0. The boundary panel in Graph Explorer shows how many land directly on a Tier 0 identity.
One target per acceptance. An acceptance covers the first boundary listed in Escapes into.
No automatic action. Escapes are never fixed automatically. A person investigates, removes the edge through Select Fire or accepts the risk.
Names, not keys. Boundaries show their connector names. Hover over a name in the flyout to see the underlying key.

Troubleshooting

Symptom	Cause and fix
The sidebar has no Boundary Escape link.	The link shows for Operators and Admins only. Ask an Admin to change your role.
"Boundary escapes aren't ready yet"	No analysis has finished since the last start or connection. Wait for the next sync and analysis.
"Couldn't load boundary escapes"	The load failed. Reload the page. If it keeps failing, open Platform Health.
"No boundary escapes" on a hybrid environment	Check that both the forest and the tenant are connected and that a sync finished. A new boundary stays unassessed until the next analysis. See Graph Explorer.
A banner says the list stopped loading early.	The page loaded some rows. Refresh to retry. Don't treat a partial list as complete.
Accept the risk is disabled.	Your license is read-only. See License Enforcement.
"Only an Admin can accept a high-criticality escape."	The escape reaches a Critical or Tier 0 target. Ask an Admin to accept it.
An accepted escape is back on Active escapes.	It reached a new boundary, a target became more critical, or its review date passed. Review it and accept it again if it's still by design.
Every row says Investigate and Theoretical.	Expected today. See Tiered Fidelity™ of an escape.