Azure Automation Flaw Enabled Cross-Tenant Identity Takeover

Microsoft has patched a critical configuration flaw in Azure Automation that, combined with a chain of code vulnerabilities, could have allowed attackers to take over identities belonging to other tenants in the cloud platform. The issue stemmed from an Azure Automation service running with a public-by-default setting, exposing internal components that should have remained isolated. Researchers discovered that by exploiting this misconfiguration alongside additional code flaws, an attacker could seize another tenant's managed identity and pivot to sensitive resources across the Azure environment.

The attack chain enabled unauthorized access to data, credentials, and resources belonging to other Azure customers. Managed identities in Azure Automation are designed to let services authenticate to other Azure resources without storing credentials, but the flaw meant these identities could be hijacked across tenant boundaries. Once inside, attackers could potentially read secrets from Azure Key Vault, manipulate runbooks, and exfiltrate automation account credentials. The chained vulnerabilities highlighted how a single default-insecure setting can cascade into a multi-tenant compromise scenario with broad blast radius.

Microsoft has since remediated the publicly exposed component and addressed the underlying code flaws. Security teams running Azure Automation workloads are advised to audit their managed identity configurations, review runbook permissions, and verify that automation accounts are not inadvertently exposing internal endpoints. Administrators should also check their own Azure tenant posture using tools that can reveal exposed services — running a port scanner against public endpoints and a SSL/TLS checker can help confirm whether Azure-related subdomains are leaking internal metadata or misconfigured certificates.

Given that compromised identities often lead to credential reuse, defenders should also verify whether any leaked passwords from their organization have surfaced in known collections. A quick check with the password checker and the email breach checker can flag exposed credentials before attackers weaponize them across cloud tenants.