Collected research
One Token to rule them all — obtaining Global Admin in every Entra ID tenant via Actor tokens
Reverse-engineers Microsoft Entra actor tokens and shows how an improperly constrained token path could yield Global Administrator access in arbitrary tenants. The article traces the token exchange, validation assumptions, exploitation chain, and Microsoft's remediation.
Record
- Date
In the archive
Tags
This page is the archive's own catalogue record. The research is the work of its author, first published at the original source. Preserved copies are kept so the citation survives its host.