Universal tenant restrictions block unauthorized external tenant access

Overview

Without universal tenant restrictions configured, users on corporate devices and networks can authenticate to unauthorized external Microsoft Entra tenants and access cloud applications by using external identities. This vulnerability makes it possible for a threat actor to use compromised user credentials or established persistence on a corporate device to authenticate to a tenant they control. They can bypass traditional network security controls that can’t inspect encrypted authentication traffic to Microsoft identity endpoints.

Once authenticated to an external tenant, a threat actor can access Microsoft Graph APIs and cloud services. This access enables data exfiltration through OneDrive, SharePoint, Teams, or any Microsoft Entra-integrated application in the external tenant. This attack path exploits the inherent trust that corporate networks and devices have with Microsoft identity services. Universal tenant restrictions address this vulnerability by injecting tenant identity headers into authentication plane traffic through Global Secure Access. Microsoft Entra ID uses these headers to enforce tenant restrictions v2 policies that block authentication attempts to unauthorized external tenants.

Remediation

• Set up tenant restrictions v2 policies to block all external tenants by default.
• Turn on universal tenant restrictions signaling in Global Secure Access.
• Deploy Global Secure Access client on devices.
• Enable the Microsoft traffic profile.

Run it

The check runs as part of the whole assessment, with the ZeroTrustAssessment module installed:

Install-Module ZeroTrustAssessment -Scope CurrentUser
Connect-Maester
Invoke-Maester -Pack ZTA -SkipBuiltIn

Leave out -SkipBuiltIn to run Maester’s own checks in the same run.

About this check

Severity	High
Effort to fix	Medium
Impact on users	Low
Pillar	Network
Category	Global Secure Access
Product	Entra ID
Feature	Global Secure Access
Area	External access and sharing
ATT&CK	T1567.002 Exfiltration to Cloud Storage, T1078.004 Cloud Accounts
Licence	Entra_Premium_Internet_Access, AAD_PREMIUM
Tenant	Workforce, External

Product, feature, area and ATT&CK are Maester’s: the assessment does not record them, so Maester keeps them in the pack’s taxonomy.json.

A Microsoft check, part of the Zero Trust Assessment pack. Text from ZeroTrustAssessment 3.1.0, © Microsoft, MIT licence.