If anyone from Microsoft security reads this, could you please do something about login.microsoftonline.com/XXX/v2.0/adminconsent?<p>The callback you're redirecting the user to at the end of that flow is forgeable if an attacker knows an azure tenant ID of a different customer, and putting a "Never use the tenant ID value of the tenant parameter to authenticate or authorize users" warning in the docs is only helpful as long as a way to authenticate users exists.
They'll see it, tell a manager, it'll get added as a ticket to an Azure Devops board under the initiative for this month under the epic for employee suggestions, which will be reviewed & prioritised by Copilot and sent to a <i>different</i> middle manager as a weekly summary email and then automatically closed when no human ever interacts with the ticket after three months.
When it comes to the amount of cross-tenant leaks Azure looks to be way ahead the competition. Makes me wonder why enterprises still flock there.
> Makes me wonder why enterprises still flock there<p>Well, when you're already paying Microsoft $/user/month for Intune, Teams&co. you might as well use Azure too.<p>Only one vendor relationship to manage, and I suspect you probably have to spend far less money than you do with AWS to get some personal attention.
> <i>one vendor relationship to manage</i><p>Anyone that's had to deal with Microsoft will tell you this means nothing<p>If you can even get attention from someone, you'll be bounced between teams and people who barely know the products they are "supporting"<p>Don't get me started on the Azure and O365 management portals<p>The only worse support experience I've had was with Oracle where it could take days just to get the boilerplate "send us your logs" response on a Sev1 issue, despite the logs already being provided in the initial ticket<p>In both cases, this is while at F100 companies with millions of dollars of licensed software and premium support contracts
Managing a vendor relationship is the act of distributing license usage through your people, reviewing contracts, having somebody that knows when and where you have to send money so that the software keeps working, and making sure you are not doing something against the contract.<p>With Microsoft that takes several people working full time. Corporations tend to not want more of those relationships to manage.
I'm convinced all engineers in the O365 org are call center techs in disguise
What do you mean "even get attention from someone"? Enterprise contracts have support included. You can get an engineer on the phone within 24 hours. As long as you are competent enough to answer their questions, their support has been fairly good in my experience.
> Anyone that's had to deal with Microsoft will tell you this means nothing...<p>In relation to everything you said in your post, let's just say <i>"trust me, I know"</i>.<p>But you missed the point I was making.<p>The GP said "Makes me wonder why enterprises still flock there".<p>And anyone who's had to deal with enterprise procurement knows if you've got a vendor on the list then its easier to deal with that one than push for multiple.<p>And then there's the whole budgeting thing. If management can see you're already buying every single employee in the org a Teams license, then getting extra budget for some Azure toys will probably be an easier sell then "yeah, I know we're paying Microsoft a lot of money, but can we have some AWS too". Since in their eyes Azure and Teams licenses is the same thing, "money for Microsoft".<p>Sadly the tech desk experience in enterprises tends to fall low down the list, if it is considered at all.<p>Sure, in theory, if you've got a good CTO to fight your corner then YMMV, but not everyone does.
Must be convenient to get all your security bugs from one vendor...
Same reason as it was in 2002. “No one ever got fired for buying Microsoft.”
Lets get our Cloud...from the same guys who have been unable to provide a freeze screen feature in Teams for 10 years..should be a firing offense...
In 2026, it's also: "They have FedRAMP, and some "cyber" person told me we need GCC-High to pass an audit."
It pretty much applies to everything, going along the tide is always easier
Good time to start.
I do .NET full time, every shop I've worked at was on Azure. It makes the most sense for .NET developers, but I'd personally prefer to just rent dedicated servers at this point.
For us a big part is that they have data centers in our country. It makes for improved latency and also makes a lot of our customers sleep better (justifiably so or not).<p>Amazon doesn't and regardless nobody feels comfortable using Google, who knows when they'll discontinue a product we would rely on.<p>So not a lot left to choose from.
Their sales folks are very good with C level folks, from the meetings I've sat in on. They will give you substantial credits and hands on support to build for you, depending on vertical and predicted future spend, especially if you're already at another cloud provider they're trying to pull you from.
Feels. AKA stupidity, ultimately.
This guy must be the nightmare of Azure developers, kudos for the incredible work on finding these vulnerabilities!
maybe we should tag submissions with dates now?<p>[2026-10-02]<p>beginning of curent month feels like two years ago when multiple vulns drop daily
path traversal and IDOR..<p>likely been active since the inception of these capabilities<p>wonder if the recommendation to "add randomness to resource names" is because of this (unrelated security by obscurity lol)
Ok so.<p>Microsoft had an egregious cross-tenant vulnerability (really, how many cross-tenant vulnerabilities did other clouds have?).<p>Vulnerability was reported.<p>They fixed it - incorrectly. Reported again.<p>They fixed it this time... and broke the previous fix. So it's vulnerable again.<p>What a clown show.
Really not surprising given the history of sloppy coding, elementary authentication mistakes, outsourced "support", and anecdotal reports of horrid internal culture over the past few years<p>[2026] Erosion of Trust @ Azure<p><a href="https://news.ycombinator.com/item?id=47616242">https://news.ycombinator.com/item?id=47616242</a><p><a href="https://isolveproblems.substack.com/p/how-microsoft-vaporized-a-trillion" rel="nofollow">https://isolveproblems.substack.com/p/how-microsoft-vaporize...</a><p>[2026] <a href="https://www.microsoft.com/en-us/security/blog/2026/05/18/storm-2949-turned-compromised-identity-into-cloud-wide-breach/" rel="nofollow">https://www.microsoft.com/en-us/security/blog/2026/05/18/sto...</a><p>[2025] <a href="https://www.cisa.gov/news-events/alerts/2025/07/20/microsoft-releases-guidance-exploitation-sharepoint-vulnerability-cve-2025-53770" rel="nofollow">https://www.cisa.gov/news-events/alerts/2025/07/20/microsoft...</a><p>[2025] <a href="https://www.securityweek.com/all-microsoft-entra-tenants-were-exposed-to-silent-compromise-via-invisible-actor-tokens-researcher/" rel="nofollow">https://www.securityweek.com/all-microsoft-entra-tenants-wer...</a><p>[2024] <a href="https://www.cloaked.com/post/microsoft-data-breach" rel="nofollow">https://www.cloaked.com/post/microsoft-data-breach</a><p>[2023] <a href="https://www.reuters.com/world/us/chinese-hackers-stole-60000-emails-us-state-department-microsoft-hack-senate-2023-09-27/" rel="nofollow">https://www.reuters.com/world/us/chinese-hackers-stole-60000...</a><p>[2023] <a href="https://www.wiz.io/blog/storm-0558-compromised-microsoft-key-enables-authentication-of-countless-micr" rel="nofollow">https://www.wiz.io/blog/storm-0558-compromised-microsoft-key...</a><p>[2022] <a href="https://www.spiceworks.com/it-security/cloud-security/news/microsoft-azure-cloud-misconfiguration/" rel="nofollow">https://www.spiceworks.com/it-security/cloud-security/news/m...</a><p>[2022] <a href="https://techcrunch.com/2022/03/23/microsoft-lapsus-hack-source-code/" rel="nofollow">https://techcrunch.com/2022/03/23/microsoft-lapsus-hack-sour...</a><p>[2021] <a href="https://www.cpomagazine.com/cyber-security/microsoft-power-apps-data-leak-fallout-38-million-records-exposed-state-and-city-governments-among-those-breached/" rel="nofollow">https://www.cpomagazine.com/cyber-security/microsoft-power-a...</a><p>[2021] <a href="https://www.darkreading.com/cloud-security/microsoft-azure-cloud-vulnerability-exposed-thousands-of-databases" rel="nofollow">https://www.darkreading.com/cloud-security/microsoft-azure-c...</a><p>And this is just the Azure / O365 stuff - there's been thousands of Windows client/server and Office software exploits across the same time period
They keep forgetting to put "make no mistakes" in the copilot prompt!
“Go to the cloud!”, they said.<p>The cloud:<p>Let’s see how their platform design holds up in the coming years, and if it can hold up to LLMs doing more of this same type of discovery and whether MSFT can fix it.
God. I would hate to be the engineer forced to have enough Azure experience to be able to find these bugs and understand Azure’s infrastructure on this level.<p>Should have been addressed in the Geneva conventions.
Reporting cross-Tenant issues as an outsider with a vulnerability chain gets you $$$.<p>Reporting “theoretical” issues with validation as an Employee gets you a lot of questions as to why you were looking.<p>Oh well.
So MSFT discourages employees from reporting vulnerabilities?<p>That explains a lot.
> Reporting “theoretical” issues with validation as an Employee<p>Microsoft still has employees ? ;)<p>(Sorry. Low bar. But in all honesty I thought they outsourced the majority of ops. I was surprised to hear in recent news that they actually had that many employees left)
[flagged]
[flagged]