Azure Tenant Takeover: From Exposed Config to Global Admin
By Rogier Dijkman — — 12 min read
Topics: Azure, Security, Entra ID, Defense
MITRE ATT&CK: T1530, T1528, T1098.001, T1078.004
A soft-deleted file in a public blob container, still retrievable through versioning, leaks a SAS token that exposes an entire file share, ultimately cascading into a complete Azure tenant takeover through managed identity abuse, federated credential injection, and Graph API self-escalation.