The only way I could think of that “attack” happening if the attacker happened to be the same user who initially setup the same account. I could easily be wrong

The only way I could think of that “attack” happening if the attacker happened to be the same user who initially setup the same account. I could easily be wrong of course, but the post doesn’t document the steps to reproduce that vulnerability. We don’t use Azure Kubernetes Services, nor Azure Public IPs services. So I’m not sure what those are. Or how throwing hem into the mix could expose an issue. We do use Azure Web Apps (which used to be called Azure Websites in 2014 as OP mentions) and I have to deal with domain validation bullshit for our org at least once every every 3 or 4 months depending on the year. And i know that the scenarios OP is describing is only feasible if the attacker is *within* your organization. Which they could do a lot more harm than just hijacking a DNS resolution endpoint.