ExposedToTenant

A RAM share whose principal is the organization root (o-*) exposes the shared resource to every current and future member account in the organization - ExposedToTenant.

Cosmos DB account with firewall restricted to 0.0.0.0 (all Azure IPs) - accessible from any Azure-hosted workload but not the open internet.

Public-network + Allow-default firewall exposes the data plane tenant-wide (still Entra-authz).

Allow Azure services rule (startIp=endIp=0.0.0.0) exposes the SQL server to all Azure tenants and multi-tenant services - not public internet but broad cross-tenant exposure.

A CA-pool binding granting requester/use to allUsers/allAuthenticatedUsers exposes issuance broadly.

Firebase Security Rules requiring only 'request.auth != null' (authenticated but no domain/claim restriction) make the Firestore database accessible to any Firebase Auth user - including users outside the organization.

A bucket IAM binding granting any read role to allAuthenticatedUsers makes the bucket readable by any Google-authenticated user worldwide (not limited to the organization) - broad tenant-wide exposure including external Google accounts.

A key allow policy binding allUsers/allAuthenticatedUsers to a crypto role exposes it broadly.

A snapshot with allAuthenticatedUsers or allUsers in its IAM policy is exposed to all GCP identities (authenticated or nominally public) across all projects/organizations.

A secret allow policy binding allUsers/allAuthenticatedUsers to secretAccessor exposes the payload broadly.

An IAM binding on a Firestore database naming 'allAuthenticatedUsers' allows access to any GCP-authenticated user, exposing data tenant-wide.

A dataset ACL entry for allAuthenticatedUsers makes it readable by any Google-authenticated user - org-wide or tenant-wide exposure.