Microsoft patched a critical misconfiguration in Azure Automation that exposed organizations to cross-tenant identity takeover attacks. The service's public-by-default settings, combined with a chain of code vulnerabilities, allowed attackers to impersonate other tenants and access sensitive data, credentials, and cloud infrastructure.
The vulnerability stems from Azure Automation's runbook execution model, which processes automation scripts in shared environments. By default, certain Automation Account configurations were accessible to external parties without authentication. An attacker exploiting this could chain multiple flaws to escalate privileges, assume identities across tenant boundaries, and compromise workloads belonging to other organizations.
The attack path involved accessing publicly exposed Automation Accounts, injecting malicious code into runbooks, and leveraging default managed identities with elevated permissions. Once inside, threat actors gained the ability to read secrets stored in Key Vaults, enumerate cloud resources, and potentially move laterally across victim infrastructure.
Microsoft did not attribute the discovery to a specific threat actor or confirm active exploitation in the wild. However, the cross-tenant nature of the vulnerability presents severe risk. Azure Automation handles critical operational tasks for thousands of enterprises, including deployment pipelines, configuration management, and backup operations. Compromise of these services could cascade into widespread infrastructure outages or data theft.
The vendor addressed the issue through configuration changes and patched the underlying code flaws. Microsoft recommended customers review Azure Automation Account access controls, disable public access where unnecessary, and implement least-privilege identities for runbook execution. Organizations should audit runbook activity logs for unauthorized modifications and verify that managed identities operate only within required scopes.
Azure Automation customers with multi-tenant setups face the highest risk. Those running sensitive workloads or maintaining privileged access through Automation Accounts should prioritize immediate review of their configurations and implement network-level restrictions to limit exposure.