Microsoft addresses a public‑by‑default configuration in Azure Automation that could allow attackers to seize another tenant’s identity.

Microsoft has confirmed that a default configuration in Azure Automation can inadvertently expose cross‑tenant identity information, potentially allowing threat actors to hijack accounts in other Azure tenants.

What the misconfiguration entails

By default, Azure Automation creates a service principal that is granted the Reader role across the entire tenant. This principal is also automatically replicated to any new tenant that a customer creates, without requiring explicit consent.

If an attacker gains access to the service principal in one tenant, they can leverage the replicated credentials to request tokens for resources in another tenant, effectively achieving a cross‑tenant identity takeover.

How attackers could exploit the setting

The exploitation chain typically involves three steps:

  • Compromise the service principal in the initial tenant, often through phishing or credential stuffing.
  • Use the compromised credentials to request a token for the replicated principal in a target tenant.
  • Access resources in the target tenant with the obtained token, bypassing normal authentication controls.

Because the service principal inherits the Reader role, attackers can enumerate resources and potentially pivot to higher‑privilege accounts if additional misconfigurations exist.

Microsoft’s response

Microsoft has issued an advisory urging customers to disable the automatic creation of the cross‑tenant service principal and to audit existing principals for unintended permissions. The company also recommends enabling Azure AD Conditional Access policies to monitor anomalous token requests.

Customers can remediate the issue by navigating to the Azure Automation account settings, turning off the Enable cross‑tenant access toggle, and reviewing the list of service principals under Azure AD > Enterprise applications.

Best practices to prevent similar issues

Security teams should incorporate the following measures:

  • Regularly audit service principals and their assigned roles.
  • Implement least‑privilege principles for automation accounts.
  • Apply Conditional Access policies that require MFA for privileged token requests.
  • Monitor Azure Activity logs for unusual cross‑tenant token issuance.

Staying vigilant about default configurations can reduce the attack surface and prevent inadvertent credential exposure across tenants.

Dark Reading coverage of Azure Automation cross‑tenant identity takeover