How Nearly All M365 Tenants Were Exposed to Potential Compromise

Last month, a critical vulnerability in Microsoft Entra ID (formerly Azure AD) was quietly patched after a security researcher discovered a flaw that could have enabled full cross-tenant impersonation. The bug exploited undocumented “Actor tokens” used in service-to-service communication, allowing an attacker to impersonate any user, including Global Admins, in any tenant. The vulnerability earned a CVSS score of 10.

This flaw was more than just a token validation issue. It was a systemic exposure rooted in the architectural complexity of Microsoft 365. It allowed attackers to bypass tenant boundaries entirely, leaving no logs in the victim tenant. That means traditional detection methods relying on native Microsoft telemetry would have been blind to the attack. Had this exploit made it out of the lab and into the wild, organizations relying solely on Microsoft’s built-in security stack may not have been able to detect a tenant-wide compromise until it was too late.

An Exponential Cascade of Compromise

The real danger wasn’t just in impersonating a single user, it was in how the vulnerability could have scaled. Microsoft 365’s B2B collaboration model creates guest accounts across tenants, and these accounts store a user’s netId in the alternativeSecurityIds attribute of the JSON Web Token (JWT) used to authenticate a guest user. This identifier links a guest account back to its native identity in the home tenant.

Figure 1. Linked attributes in the JWT used for B2B guest authentication in M365.

Here’s how an attacker could have abused this:

1. Start with any tenant where the attacker has a guest account.
2. Query guest users in the target tenant and extract their netId from the alternativeSecurityIds attribute of the guest account object.
3. Determine the home tenant from the UPN (User Principal Name; e.g. account username) domain.
4. Craft an Actor token impersonating the user in their home tenant.
5. Enumerate users in the home tenant, escalate privileges, and compromise the tenant.
6. Repeat across all guest-linked tenants.

Each step requires only two API calls per tenant and none of them generate logs. Given that most tenants have guest users from multiple external organizations, the compromise could have scaled exponentially in minutes. In fact, many service providers and Microsoft consultants have guest accounts in Microsoft’s own tenant, meaning a compromise of Microsoft could have cascaded into its entire partner ecosystem.

So How Do We Secure M365?

This incident further reinforces something most of us instinctively know: Microsoft 365 is a highly complex, interconnected system. While Microsoft responded promptly and issued a fix within a few days, the fact that such a vulnerability existed at all should prompt serious reflection.

As defenders, we must always ask ourselves how an exploit like this could’ve been prevented. A modern MDR (Managed Detection and Response) solution ingests telemetry from multiple sources (endpoints, networks, cloud apps), applies behavioral analytics, and correlates identity activity across the IT infrastructure of your entire organization. Modern MDR can detect anomalies in user behavior, token usage, and privilege escalation.

For example, while Actor tokens don’t generate logs during read operations, they do leave behind strange footprints during write operations. In some cases, audit logs show actions initiated by “Exchange” but attributed to a Global Admin’s UPN. A quality MDR analytics engine is designed to flag these kinds of inconsistencies, giving defenders a fighting chance even when the platform itself isn’t able to recognize the potential threat.

So What Now?

This particular vulnerability may be resolved, but the broader lesson remains with us. Namely, that use of complex systems will likely always carry some level of risk. Organizations need to assume that vulnerabilities like this will keep surfacing and prepare accordingly. So what can be done to secure our identity providers (like Entra) today?

• Restrict B2B collaboration: Review and tighten policies around guest access. Limit who can send invitations and consider disabling automatic acceptance of guest users.
• Implement conditional access policies: Use risk-based access controls to limit exposure from compromised accounts or suspicious login behavior.
• Audit and monitor guest accounts: Regularly review who has access, what they can see, and whether they still need it.
• Leverage Modern MDR solutions: These services provide continuous monitoring, threat detection, and rapid response, capabilities which are critical for identifying abuse of identity systems before damage is done.
• Partner with a trusted security provider: Especially one with experience in your industry. A good partner can help you navigate Microsoft’s evolving security landscape and tailor defenses to your specific risk profile.

Microsoft 365’s complexity isn’t going away, and neither is the risk. But with proactive controls, vigilant monitoring, and the right partnerships, organizations can stay ahead of the threats.