MICROSOFT ENTRA DESIGN LETS GUEST USERS GAIN AZURE CONTROL, RESEARCHERS SAY

Summary from the TLDR InfoSec newsletter

BeyondTrust researchers found that guest users in Microsoft Azure can create and transfer Azure subscriptions, gaining "Owner" privileges without admin approval. Guests with billing authority can use Microsoft's transfer feature to move subscriptions, bypassing normal access controls. Microsoft states this supports multi-tenant scenarios, but enabling it by default poses significant security risks that organizations need to address with subscription policies and guest account audits.