Cross-tenant access is the policy-controlled ability for identities, applications, or resources in one organization’s cloud tenant to interact with another tenant. In platforms like Microsoft Entra, tenants are meant to be separate identity boundaries, so this kind of access should only happen when administrators explicitly allow it through trust settings, consent, or federation rules.
It matters because tenant separation limits blast radius. If cross-tenant access is misconfigured or bypassed, an attacker may move from one organization into another, reuse tokens, or confuse which tenant a managed identity belongs to. Defenders treat this as a high-risk trust path: review cross-tenant policies, restrict app consent, monitor unusual authentication between tenants, and keep automation identities and service principals on least privilege. In attacks, the goal is often identity confusion; in defense, the goal is to make every boundary crossing deliberate and auditable.