3 ms·
That's not a misconfiguration: they completely skipped the authorization checks in the applications. Even when you limit Azure's SSO to your own tenant, you sho
by tgv 4y ago
That's not a misconfiguration: they completely skipped the authorization checks in the applications. Even when you limit Azure's SSO to your own tenant, you should check if the account is permitted to change a minor thing such as Bing's frequent searches page.
The "Am I affected" section downplays the effect. If I understood it properly, this could already have been exploited, and nobody would ever be the wiser.
- TheNewsIsHere 4y agoThat's the crux of this. There are no surprises in AAD behavior here, it's just that Microsoft put developers or security people on these products that missed the mark. Everyone makes mistakes in their careers, but these are some awfully big mistakes with awfully big stakes.