ISVs and MSPs can limit cross-tenant exposure by reviewing app design, credentials, consent and workload identity controls.