The tenant boundary is meant to separate organizations, but B2B collaboration and cross-tenant access settings punch holes in it. A guest account is a foothold inside a tenant you are external to, and loose cross-tenant trust can let claims (MFA, device compliance) or synchronization from one tenant carry into another.
What folds in here#
- Guest access: B2B invitation, guest enumeration, and guest-to-member escalation.
- Cross-tenant access: inbound trust and cross-tenant synchronization abuse.