Rendered at 22:56:14 GMT+0000 (Coordinated Universal Time) with Cloudflare Workers.
unddoch 4 days ago [-]
If anyone from Microsoft security reads this, could you please do something about login.microsoftonline.com/XXX/v2.0/adminconsent?
The callback you're redirecting the user to at the end of that flow is forgeable if an attacker knows an azure tenant ID of a different customer, and putting a "Never use the tenant ID value of the tenant parameter to authenticate or authorize users" warning in the docs is only helpful as long as a way to authenticate users exists.
birdsongs 4 days ago [-]
They'll see it, tell a manager, it'll get added as a ticket to an Azure Devops board under the initiative for this month under the epic for employee suggestions, which will be reviewed & prioritised by Copilot and sent to a different middle manager as a weekly summary email and then automatically closed when no human ever interacts with the ticket after three months.
rsalus 4 days ago [-]
speaking as a FTE at Microsoft... yup
0xWTF 4 days ago [-]
Glad to know the frozen middle exists among the hyperscalers. High confidence you can swap the entire leadership team and nothing will change.
jiggawatts 4 days ago [-]
> frozen middle
That’s the best new term I’ve learned in months!
pphysch 4 days ago [-]
See also "defensive bureaucracy"
Henchman21 4 days ago [-]
I spent 6 months working as a contractor in MS’ Chicagoland data centers. Nothing worked — phones on the walls ran Windows and did not give dial tone. Security systems unable to function because of Windows updates. Personnel more concerned with their required LinkedIn updates than their jobs. Not one FTE liked their role — everyone had a foot out the door.
When they offered to make me FTE I declined and moved on. Because it was an obvious absolute shit-show.
Sorry for those that are currently employed by MS.
throwup238 4 days ago [-]
It’s not all bad. When I was there, the Washington campus had a restaurant with a three course menu for $15, designed by a Seattle celebrity chef.
gscott 4 days ago [-]
Come for the paycheck... stay for the food!
Henchman21 3 days ago [-]
We had a vending machine that required an app that made you buy tokens to access the food in the vending machines. Said app was a masterpiece of dark patterns. Put money in, maybe, if you're lucky, get food out. Maybe.
4 days ago [-]
wibartle 4 days ago [-]
That's me. But I don't understand your comment. Could you expand on it, either in a reply or preferably by email or via an MSRC case? You can reply with the vuln number so I can fast route it.
> The callback you're redirecting the user to at the end of that flow is forgeable
The redirect_uri is checked against the app registration. There's a general OAuth problem called "open registration redirects" that applies here, about which we've [blogged](https://www.microsoft.com/en-us/security/blog/2026/03/02/oau...) - but frankly, none of the industry solves this well.
In general, "I can create a link that goes to malware via X endpoint" isn't very interesting - you can also just create a direct link to the malware. Web browsers won't reliably show you the real destination of a link anyhow and even if they did, it's mostly just us hackers who understand URLs at all.
> as long as a way to authenticate users exists.
I'm lost. Entra supports [OpenID Connect](https://learn.microsoft.com/en-us/entra/identity-platform/v2...) for authentication. Most portals that surface admin consent authenticate the user with an OpenID Connect request either immediately before or after the admin consent request.
unddoch 2 days ago [-]
I am a service provider. I have an Azure app registered so that clients can connect my app to their Azure environment.
Client A connected their Azure env to my service. Now an attacker creates a different tenant at my service and goes through the integration flow. Then he sends a request to my callback that says "admin consent configured for client A's tenant" and wants to steal Client A's data. How do I protect against that? Should I validate that the user who started the flow belongs to the same Azure tenant id? In itself it's not enough, what if it's just a random user without actual permissions to go through admin consent? What if a client legitimately has multiple tenants in my service that need to connect to the same azure tenant?
wibartle 1 days ago [-]
> Should I validate that the user who started the flow belongs to the same Azure tenant id?
Yeah. Basically, I'd expect most services are responding to the admin consent callback by saying "Admin consent flow complete. Redirecting to previous page" (usually some setup flow page). Then that page does whatever it normally does (presumably OpenID Connect sign-in with a cache in cookies / localStorage / sessionStorage) to authenticate the user.
So in a typical flow, the user is already signed in, and your service just reads their identity out of storage after the admin consent flow. If your service receives an unsolicited admin consent callback (and so there is no "previous page" and no user is signed in), I'd expect it goes to your service home page which either tries to sign the user in or shows an unauthenticated experience.
That's to say - most services setup flows are multi-step anyway. First the customer provides some information, then they sign a contract, then they pay, then they admin consent, then they configure your service's primary configuration. If admin consent is launced from /setupwizard/step4, then after admin consent, you go on to /setupwizard/step5. The normal thing step5 does (presumably, checking that the user is signed in, and then show the primary configuration user interface) should be good enough, just the same as if somebody randomly hit step5 without hitting step4 previously.
unddoch 16 hours ago [-]
I want to first say thanks for engaging with me on this issue so directly, much appreciated.
As I said earlier - validating that the customer controls an azure user doesn't necessarily mean that they have permissions to grant admin consent.
Further, I think you perhaps kind of implicitly assume that when I authenticate users I do that by their Azure identity. In practice that can be a whole spectrum - whether I have my own user management system, and whether I couple it to Entra or not is not something you can rely on. Customers expect their preferred IdP to work with your service.
Making this inherently secure is just not that hard here - you could easily make this a bit more PKCE like with an additional service->azure call before redirecting the user to the flow or by adding a symmetrical signature to the callback and a new API to verify the signature.
publlus_enigma 4 days ago [-]
I'm sure one of the 60,000 employees who have been told they're welcome not to work there anymore, because the line must go up infinitely, will be chomping at the bit to do so.
nikanj 4 days ago [-]
I love that this is the most reliable way to actually contact an actual human working at Microsoft
collabs 4 days ago [-]
Reaching an actual human at Microsoft isn't enough. You have to reach the correct humans which is a much harder task. For example, you might have an idea. What if azure devops had a field for date component only, not date time, just the date because it would help you in an internal project. Can you find out who to reach? Even if you work at Microsoft, I would bet you cannot. Even when you find a defect in an internal product you are using, getting to a human requires you to go through layers of nonsense. I distinctly remember my manager telling me to not even bother explaining myself to the first support chat and to simply ask them to escalate. I was impressed at how they managed to make security a part of your review though. I never thought getting buy-in to update Newtonsoft.Json would be as easy as it was but a CVE meant you had to update it to whatever made the security flags happy.
Once I could reach the actual engineering team to look at the internal tool to look at the bug I had to report though, they were very responsive. The tool for communicating was cumbersome and made me feel like a vendor / customer relationship even though you are supposed to be the same team but once they realized it was an actual defect and not some harebrained feature request, they fixed it relatively quickly.
meekins 4 days ago [-]
When it comes to the amount of cross-tenant leaks Azure looks to be way ahead the competition. Makes me wonder why enterprises still flock there.
traceroute66 4 days ago [-]
> Makes me wonder why enterprises still flock there
Well, when you're already paying Microsoft $/user/month for Intune, Teams&co. you might as well use Azure too.
Only one vendor relationship to manage, and I suspect you probably have to spend far less money than you do with AWS to get some personal attention.
waz0wski 4 days ago [-]
> one vendor relationship to manage
Anyone that's had to deal with Microsoft will tell you this means nothing
If you can even get attention from someone, you'll be bounced between teams and people who barely know the products they are "supporting"
Don't get me started on the Azure and O365 management portals
The only worse support experience I've had was with Oracle where it could take days just to get the boilerplate "send us your logs" response on a Sev1 issue, despite the logs already being provided in the initial ticket
In both cases, this is while at F100 companies with millions of dollars of licensed software and premium support contracts
marcosdumay 4 days ago [-]
Managing a vendor relationship is the act of distributing license usage through your people, reviewing contracts, having somebody that knows when and where you have to send money so that the software keeps working, and making sure you are not doing something against the contract.
With Microsoft that takes several people working full time. Corporations tend to not want more of those relationships to manage.
esikich 4 days ago [-]
What do you mean "even get attention from someone"? Enterprise contracts have support included. You can get an engineer on the phone within 24 hours. As long as you are competent enough to answer their questions, their support has been fairly good in my experience.
jiggawatts 4 days ago [-]
The initial support tech is typically outsourced and responds with: “Yes, it is broken… by design.”
Attention means an engineer who can fix the problem, not an off shore phone jockey paid to make you quietly go away.
esikich 4 days ago [-]
Yes, it's triage. They do the basic steps, get relevant info, and try to figure out the right team to send it to. This is how support everywhere works.
jonathanlydall 3 days ago [-]
[dead]
rsalus 4 days ago [-]
I'm convinced all engineers in the O365 org are call center techs in disguise
traceroute66 4 days ago [-]
> Anyone that's had to deal with Microsoft will tell you this means nothing...
In relation to everything you said in your post, let's just say "trust me, I know".
But you missed the point I was making.
The GP said "Makes me wonder why enterprises still flock there".
And anyone who's had to deal with enterprise procurement knows if you've got a vendor on the list then its easier to deal with that one than push for multiple.
And then there's the whole budgeting thing. If management can see you're already buying every single employee in the org a Teams license, then getting extra budget for some Azure toys will probably be an easier sell then "yeah, I know we're paying Microsoft a lot of money, but can we have some AWS too". Since in their eyes Azure and Teams licenses is the same thing, "money for Microsoft".
Sadly the tech desk experience in enterprises tends to fall low down the list, if it is considered at all.
Sure, in theory, if you've got a good CTO to fight your corner then YMMV, but not everyone does.
DANmode 4 days ago [-]
> Anyone that's had to deal with Microsoft will tell you this means nothing
If anything, having only one vendor to choose from is a disadvantage.
quinnjh 4 days ago [-]
The management portals are something special. Hunting through 365, exchange, and azure to find policies that apply elsewhere.
jeffrallen 4 days ago [-]
Must be convenient to get all your security bugs from one vendor...
xmcp123 4 days ago [-]
Same reason as it was in 2002. “No one ever got fired for buying Microsoft.”
Betelbuddy 4 days ago [-]
Lets get our Cloud...from the same guys who have been unable to provide a freeze screen feature in Teams for 10 years..should be a firing offense...
totallykvothe 4 days ago [-]
Wdym? Teams freezes my screen all the time!
Betelbuddy 4 days ago [-]
Yeah that is a feature
I am talking about the most basic capability of a professional presentation tool like exists in Webex, or GotoMeeting or Zoom. And requested...
by more than 2000 requests across different microsoft discussion boards, including 1044 on one request alone....
siva7 4 days ago [-]
wow i've been forced to use teams for over a decade.. i didn't even realise such useful features exist in other presentation tools. like there is a world with software that actually makes my life easier!?
adamm255 4 days ago [-]
When I have to present in Teams I realise how much I lean on that feature in Zoom. Absolutely astonishing that it’s not a feature.
ok123456 4 days ago [-]
In 2026, it's also: "They have FedRAMP, and some "cyber" person told me we need GCC-High to pass an audit."
jon128 4 days ago [-]
Federal Cyber Experts Thought Microsoft’s Cloud Was “a Pile of Shit.” They Approved It Anyway.
https://www.propublica.org/article/microsoft-cloud-fedramp-cybersecurity-government
sandeepkd 4 days ago [-]
It pretty much applies to everything, going along the tide is always easier
winrid 4 days ago [-]
Good time to start.
magicalhippo 4 days ago [-]
For us a big part is that they have data centers in our country. It makes for improved latency and also makes a lot of our customers sleep better (justifiably so or not).
Amazon doesn't and regardless nobody feels comfortable using Google, who knows when they'll discontinue a product we would rely on.
So not a lot left to choose from.
giancarlostoro 4 days ago [-]
I do .NET full time, every shop I've worked at was on Azure. It makes the most sense for .NET developers, but I'd personally prefer to just rent dedicated servers at this point.
toomuchtodo 4 days ago [-]
Their sales folks are very good with C level folks, from the meetings I've sat in on. They will give you substantial credits and hands on support to build for you, depending on vertical and predicted future spend, especially if you're already at another cloud provider they're trying to pull you from.
Betelbuddy 4 days ago [-]
AI Agents are salivating at that level of incompetence....
toomuchtodo 4 days ago [-]
If there is no cost for poor decisions, nothing will be learned. Incentives drive outcomes.
publlus_enigma 4 days ago [-]
Well they're clearly market leaders being that far ahead of the competition. Maybe that's why.
/s
jon128 4 days ago [-]
Feels. AKA stupidity, ultimately.
albert_e 4 days ago [-]
maybe we should tag submissions with dates now?
[2026-10-02]
beginning of curent month feels like two years ago when multiple vulns drop daily
This guy must be the nightmare of Azure developers, kudos for the incredible work on finding these vulnerabilities!
josteink 4 days ago [-]
We contract this company at work. They’re clearly capable.
Can confirm that we’re getting our money's worth. :D
outworlder 4 days ago [-]
Ok so.
Microsoft had an egregious cross-tenant vulnerability (really, how many cross-tenant vulnerabilities did other clouds have?).
Vulnerability was reported.
They fixed it - incorrectly. Reported again.
They fixed it this time... and broke the previous fix. So it's vulnerable again.
What a clown show.
waz0wski 4 days ago [-]
Really not surprising given the history of sloppy coding, elementary authentication mistakes, outsourced "support", and anecdotal reports of horrid internal culture over the past few years
And this is just the Azure / O365 stuff - there's been thousands of Windows client/server and Office software exploits across the same time period
tencentshill 4 days ago [-]
They keep forgetting to put "make no mistakes" in the copilot prompt!
thewisenerd 4 days ago [-]
path traversal and IDOR..
likely been active since the inception of these capabilities
wonder if the recommendation to "add randomness to resource names" is because of this (unrelated security by obscurity lol)
chinathrow 4 days ago [-]
Gotta put these backdoors somewhere.
sam1r 3 days ago [-]
>> The original RuntimeUrl path was no longer validated, and as a result, you could perform that attack again. I would include some pictures, but they would be the same pictures as above, so you can just imagine them.
Such kindness & grace shown by the author. He/she could have ripped azure furthermore so easily.
xmcp123 4 days ago [-]
God. I would hate to be the engineer forced to have enough Azure experience to be able to find these bugs and understand Azure’s infrastructure on this level.
Should have been addressed in the Geneva conventions.
anonymous908213 4 days ago [-]
The outsourcing of coding to LLMs is, in this case, a humanitarian measure.
giancarlostoro 4 days ago [-]
Meanwhile they want to fire even more people there.
mapotofu 4 days ago [-]
“Go to the cloud!”, they said.
The cloud:
Let’s see how their platform design holds up in the coming years, and if it can hold up to LLMs doing more of this same type of discovery and whether MSFT can fix it.
eugenekay 4 days ago [-]
Reporting cross-Tenant issues as an outsider with a vulnerability chain gets you $$$.
Reporting “theoretical” issues with validation as an Employee gets you a lot of questions as to why you were looking.
Oh well.
outworlder 4 days ago [-]
So MSFT discourages employees from reporting vulnerabilities?
That explains a lot.
traceroute66 4 days ago [-]
> Reporting “theoretical” issues with validation as an Employee
Microsoft still has employees ? ;)
(Sorry. Low bar. But in all honesty I thought they outsourced the majority of ops. I was surprised to hear in recent news that they actually had that many employees left)
The callback you're redirecting the user to at the end of that flow is forgeable if an attacker knows an azure tenant ID of a different customer, and putting a "Never use the tenant ID value of the tenant parameter to authenticate or authorize users" warning in the docs is only helpful as long as a way to authenticate users exists.
That’s the best new term I’ve learned in months!
When they offered to make me FTE I declined and moved on. Because it was an obvious absolute shit-show.
Sorry for those that are currently employed by MS.
> The callback you're redirecting the user to at the end of that flow is forgeable
The redirect_uri is checked against the app registration. There's a general OAuth problem called "open registration redirects" that applies here, about which we've [blogged](https://www.microsoft.com/en-us/security/blog/2026/03/02/oau...) - but frankly, none of the industry solves this well.
In general, "I can create a link that goes to malware via X endpoint" isn't very interesting - you can also just create a direct link to the malware. Web browsers won't reliably show you the real destination of a link anyhow and even if they did, it's mostly just us hackers who understand URLs at all.
> as long as a way to authenticate users exists.
I'm lost. Entra supports [OpenID Connect](https://learn.microsoft.com/en-us/entra/identity-platform/v2...) for authentication. Most portals that surface admin consent authenticate the user with an OpenID Connect request either immediately before or after the admin consent request.
Client A connected their Azure env to my service. Now an attacker creates a different tenant at my service and goes through the integration flow. Then he sends a request to my callback that says "admin consent configured for client A's tenant" and wants to steal Client A's data. How do I protect against that? Should I validate that the user who started the flow belongs to the same Azure tenant id? In itself it's not enough, what if it's just a random user without actual permissions to go through admin consent? What if a client legitimately has multiple tenants in my service that need to connect to the same azure tenant?
Yeah. Basically, I'd expect most services are responding to the admin consent callback by saying "Admin consent flow complete. Redirecting to previous page" (usually some setup flow page). Then that page does whatever it normally does (presumably OpenID Connect sign-in with a cache in cookies / localStorage / sessionStorage) to authenticate the user.
So in a typical flow, the user is already signed in, and your service just reads their identity out of storage after the admin consent flow. If your service receives an unsolicited admin consent callback (and so there is no "previous page" and no user is signed in), I'd expect it goes to your service home page which either tries to sign the user in or shows an unauthenticated experience.
That's to say - most services setup flows are multi-step anyway. First the customer provides some information, then they sign a contract, then they pay, then they admin consent, then they configure your service's primary configuration. If admin consent is launced from /setupwizard/step4, then after admin consent, you go on to /setupwizard/step5. The normal thing step5 does (presumably, checking that the user is signed in, and then show the primary configuration user interface) should be good enough, just the same as if somebody randomly hit step5 without hitting step4 previously.
As I said earlier - validating that the customer controls an azure user doesn't necessarily mean that they have permissions to grant admin consent.
Further, I think you perhaps kind of implicitly assume that when I authenticate users I do that by their Azure identity. In practice that can be a whole spectrum - whether I have my own user management system, and whether I couple it to Entra or not is not something you can rely on. Customers expect their preferred IdP to work with your service.
Btw, I just found a short article referencing this issue, offering the same solution with the same "vulnerable to inside org privesc" gap: https://medium.com/@dipakkrdas/microsoft-adminconsent-can-le...
Making this inherently secure is just not that hard here - you could easily make this a bit more PKCE like with an additional service->azure call before redirecting the user to the flow or by adding a symmetrical signature to the callback and a new API to verify the signature.
Once I could reach the actual engineering team to look at the internal tool to look at the bug I had to report though, they were very responsive. The tool for communicating was cumbersome and made me feel like a vendor / customer relationship even though you are supposed to be the same team but once they realized it was an actual defect and not some harebrained feature request, they fixed it relatively quickly.
Well, when you're already paying Microsoft $/user/month for Intune, Teams&co. you might as well use Azure too.
Only one vendor relationship to manage, and I suspect you probably have to spend far less money than you do with AWS to get some personal attention.
Anyone that's had to deal with Microsoft will tell you this means nothing
If you can even get attention from someone, you'll be bounced between teams and people who barely know the products they are "supporting"
Don't get me started on the Azure and O365 management portals
The only worse support experience I've had was with Oracle where it could take days just to get the boilerplate "send us your logs" response on a Sev1 issue, despite the logs already being provided in the initial ticket
In both cases, this is while at F100 companies with millions of dollars of licensed software and premium support contracts
With Microsoft that takes several people working full time. Corporations tend to not want more of those relationships to manage.
Attention means an engineer who can fix the problem, not an off shore phone jockey paid to make you quietly go away.
In relation to everything you said in your post, let's just say "trust me, I know".
But you missed the point I was making.
The GP said "Makes me wonder why enterprises still flock there".
And anyone who's had to deal with enterprise procurement knows if you've got a vendor on the list then its easier to deal with that one than push for multiple.
And then there's the whole budgeting thing. If management can see you're already buying every single employee in the org a Teams license, then getting extra budget for some Azure toys will probably be an easier sell then "yeah, I know we're paying Microsoft a lot of money, but can we have some AWS too". Since in their eyes Azure and Teams licenses is the same thing, "money for Microsoft".
Sadly the tech desk experience in enterprises tends to fall low down the list, if it is considered at all.
Sure, in theory, if you've got a good CTO to fight your corner then YMMV, but not everyone does.
If anything, having only one vendor to choose from is a disadvantage.
I am talking about the most basic capability of a professional presentation tool like exists in Webex, or GotoMeeting or Zoom. And requested...
https://learn.microsoft.com/en-us/answers/questions/4410610/...
by more than 2000 requests across different microsoft discussion boards, including 1044 on one request alone....
Amazon doesn't and regardless nobody feels comfortable using Google, who knows when they'll discontinue a product we would rely on.
So not a lot left to choose from.
/s
[2026-10-02]
beginning of curent month feels like two years ago when multiple vulns drop daily
"… then put your little hand in mine…"
https://www.youtube.com/watch?v=XD2ZC11pPPQ
Can confirm that we’re getting our money's worth. :D
Microsoft had an egregious cross-tenant vulnerability (really, how many cross-tenant vulnerabilities did other clouds have?).
Vulnerability was reported.
They fixed it - incorrectly. Reported again.
They fixed it this time... and broke the previous fix. So it's vulnerable again.
What a clown show.
[2026] Erosion of Trust @ Azure
https://news.ycombinator.com/item?id=47616242
https://isolveproblems.substack.com/p/how-microsoft-vaporize...
[2026] https://www.microsoft.com/en-us/security/blog/2026/05/18/sto...
[2025] https://www.cisa.gov/news-events/alerts/2025/07/20/microsoft...
[2025] https://www.securityweek.com/all-microsoft-entra-tenants-wer...
[2024] https://www.cloaked.com/post/microsoft-data-breach
[2023] https://www.reuters.com/world/us/chinese-hackers-stole-60000...
[2023] https://www.wiz.io/blog/storm-0558-compromised-microsoft-key...
[2022] https://www.spiceworks.com/it-security/cloud-security/news/m...
[2022] https://techcrunch.com/2022/03/23/microsoft-lapsus-hack-sour...
[2021] https://www.cpomagazine.com/cyber-security/microsoft-power-a...
[2021] https://www.darkreading.com/cloud-security/microsoft-azure-c...
And this is just the Azure / O365 stuff - there's been thousands of Windows client/server and Office software exploits across the same time period
likely been active since the inception of these capabilities
wonder if the recommendation to "add randomness to resource names" is because of this (unrelated security by obscurity lol)
Such kindness & grace shown by the author. He/she could have ripped azure furthermore so easily.
Should have been addressed in the Geneva conventions.
The cloud:
Let’s see how their platform design holds up in the coming years, and if it can hold up to LLMs doing more of this same type of discovery and whether MSFT can fix it.
Reporting “theoretical” issues with validation as an Employee gets you a lot of questions as to why you were looking.
Oh well.
That explains a lot.
Microsoft still has employees ? ;)
(Sorry. Low bar. But in all honesty I thought they outsourced the majority of ops. I was surprised to hear in recent news that they actually had that many employees left)