EIDTNT-006: Azure B2B Cross-Tenant Access Policies
- Plataforma
- Entra ID / M365
- Categoría
- Entra ID Tenant Configuration
- Severidad
- High
- Pilar de Zero Trust
- Governance (peso 2)
- Fixtures de referencia
- 3
- Cobertura de ramas
- Observada: los fixtures prueban los veredictos que ejercitan
- Procedencia
- baseline
Qué comprueba
Cross-tenant access policies provide granular control over how users authenticate and access resources when collaborating with external Entra ID tenants. Default cross-tenant access settings may allow broad inbound and outbound access that does not align with organizational security requirements. Properly configured cross-tenant access policies enable trusted B2B collaboration while preventing unauthorized access from untrusted tenants and controlling which users can access external resources.
Valor recomendado
Default cross-tenant access policy set to block with explicit allow rules for approved partner tenants only
Remediación
Navigate to Entra ID > External Identities > Cross-tenant access settings and review the default inbound and outbound access settings. Configure the default policy to restrict both inbound and outbound access, then create organization-specific policies for approved partner tenants with appropriate access controls. Enable trust settings for partner tenants to accept their MFA claims and device compliance where appropriate, reducing authentication friction for trusted collaborations.
Veredictos probados con fixtures
Cada veredicto de esta tabla está probado por un fixture de referencia en la suite de pruebas que valida el módulo. La tabla se deriva de la última ejecución en verde; no puede editarse a mano.
| Escenario | Veredicto esperado |
|---|---|
| clean | PASS |
| known-bad | WARN |
| throttled | Not Assessed |
Mapeos a marcos de referencia
- NIST SP 800-53
- AC-20
- CIS M365 Benchmark
- 1.3.1