Would have been nice if they were clear about what authentication is required. If it is regular exchange user authentication then this is pretty bad. For those

Would have been nice if they were clear about what authentication is required. If it is regular exchange user authentication then this is pretty bad. For those who don't know? The "exchange admins" group whose members' credentials I would expect to be able to dump as SYSTEM on an exchange server, is a quasi-domain-admin group. Taking over the whole domain after that should not be difficult for threat actors. Shouldn't have to be stated but at any given time, any company regardless of security measures should assume there is at least one compromised host and stolen credential.