Inviting guest users into Entra ID tenants can lead to significant security risks due to overlooked permission escalation, especially involving subscription control via billing roles. Attackers can exploit this vulnerability to gain privileged access, perform reconnaissance, and manipulate policies covertly. #MicrosoftEntra #GuestUserRisks
Keypoints
- Billing roles operate outside typical Azure permission boundaries, enabling subscription control through billing accounts.
- Attackers can leverage compromised billing accounts or create new tenants to gain subscription ownership.
- Once privileged, attackers can modify policies, create identities, and access sensitive information within the environment.
- Organizations should audit guest accounts, restrict guest permissions, and monitor subscriptions to mitigate risks.
Read More: https://thehackernews.com/2025/06/beware-hidden-risk-in-your-entra.html