User Signed into External Teams Tenant

Mehulkumar Savajani@Msavajani

•updated Nov 28, 2025•41•2•384

Detects when an internal user successfully authenticates as a guest to an external Microsoft Teams tenant. This could be legitimate B2B collaboration, but it can also be abused by attackers to lure users into a malicious tenant where security controls (like Safe Links/Safe Attachments) are not enforced.