Microsoft Azure API Management Flaw Enables Cross-Tenant Account Creation, Bypassing Admin Restrictions

The full story

This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.

Azure API Management Flaw Allows Unauthorized Cross-Tenant Account Creation A design flaw in Microsoft Azure's API Management Developer Portal enables unauthorized account creation across different tenants. Microsoft has classified this behavior as 'by design', despite the significant security risks it poses to organizations using the service. 2 sources 31