Coursera Flash Sale
40% Off Coursera Plus for 3 Months!
Grab it
Explore a critical security vulnerability in Azure's guest user model through this 45-minute conference talk that reveals how guest users can create and own subscriptions in external tenants without explicit privileges. Discover novel research findings that expose how attackers exploit Azure subscriptions to expand access, move laterally within resource tenants, and establish stealthy backdoor identities in Entra directories. Learn about real-world attacks confirmed by Microsoft that highlight significant gaps in Azure threat models, particularly around subscription security boundaries that many administrators overlook when inviting guest users. Examine specific attack vectors that enable privilege escalation and persistent access through guest-created subscriptions, understand why this capability undermines Azure's intended security architecture, and gain insights into defensive strategies while Microsoft develops future preventative measures for this overlooked but critical security exposure.
