rage.fail

CanEnterTenant

Source can obtain a principal in the target Entra tenant (guest, multi-tenant app, B2B).

cross_boundary CONTROL nature: derived walkable weight 1 high value

Identity ── CanEnterTenant ──▸ Tenant

Source types

Identity

Target types

Tenant

States

ACTIVE CONDITIONAL POTENTIAL BLOCKED UNKNOWN

Derivation

nature	derived

Rules that emit CanEnterTenant 3

azure-mhsm-guest-crosstenant

A guest/foreign-tenant principal granted a Managed HSM local role gains cross-tenant crypto access.

azurederived

admin-inherits-down-contains

Control of a parent administrative boundary inherits transitively to every descendant boundary and resource via Contains*.

derived

enter-boundary-rollups

Materialize a foothold identity inside a subscription/project/tenant/organization when a principal can impersonate/assume/federate into an identity homed there; escalate to Controls only when entry implies admin at a top boundary.

derived