Skip to main content
SecureAuthSecureAuth
Back to Blog
Architecture
January 27, 2026
8 min read

"Microsoft on Microsoft" Hack: Why Hierarchical Tenancy Wins Over Flat Multi-Tenancy

Konrad Holowinski

In the world of Identity and Access Management (IAM), we often talk about "multi-tenancy" as a universal good—it's how the cloud scales. But as security researcher Visha Bernard demonstrated at Black Hat, not all multi-tenancy is created equal.

His presentation, "Microsoft on Microsoft," revealed a startling reality: if your identity provider is "flat," a single developer oversight can turn your internal tools into an open house for any attacker with a credit card and a personal tenant.

The Core Vulnerability

When an application trusts "any token signed by Microsoft" without checking the Tenant ID, attackers can use their own personal tenant's "Admin" role to access internal applications they should never reach.

The Problem: The "Flat" Identity Pitfall

In the Microsoft Entra ID (Azure AD) model, multi-tenancy is essentially a flat, global pool. When a developer clicks "Multi-tenant" on an application registration, they are essentially telling that app: "I will trust any token signed by Microsoft."

The vulnerability Bernard exploited relied on the fact that an attacker could:

The "Microsoft on Microsoft" Attack Flow

1
Attacker Creates Tenant

Personal tenant with self-assigned 'Admin' role

2
Targets /common Endpoint

Redirects login request to flat global endpoint

3
Valid Token Issued

Microsoft signs token with 'Admin' claim

4
App Trusts Token

No Tenant ID check = unauthorized access

Result: 22 compromised high-value Microsoft internal applications discovered at Black Hat, all because developers forgot to validate the Tenant ID.

Because the architecture is flat and uses a global /common endpoint, the application receives a validly signed token, sees the "Admin" role, and lets the attacker in. The only thing preventing this is the developer manually writing code to check the Tenant ID.

As Bernard proved with 22 compromised high-value apps, developers often forget that step.

The SecureAuth Difference: Hierarchical Tenancy

SecureAuth approaches identity with a fundamentally different blueprint: Hierarchical Multi-Tenancy. Instead of a flat pool where everyone is a peer, SecureAuth organizes identity into a structured "tree" of Workspaces and Realms.

Flat Multi-Tenancy

Global /common Endpoint
All tenants are peers in a flat pool
Open by default, must filter out
Any valid Microsoft token accepted
Developers must manually check Tenant ID
Single 'door' for all users globally

Hierarchical Multi-Tenancy

Structured Workspace Tree
Workspaces and Realms in hierarchy
Isolated by default, build bridges explicitly
Only trusts IdPs within lineage
Roles scoped to workspace branches
Unique endpoints per organization

Here is why this hierarchy is the ultimate defense against the "Microsoft on Microsoft" attack:

1

Isolation by Inheritance, Not Filtering

THE PROBLEM

Flat model: open by default, write code to filter out the world

SECUREAUTH SOLUTION

Hierarchical model: isolated by default, apps only trust IdPs within their lineage

2

Scope-Bound Administrative Roles

THE PROBLEM

Flat model: 'Admin' role from any tenant is trusted

SECUREAUTH SOLUTION

Hierarchical model: roles scoped to workspace branch—'Is this person admin within MY branch?'

3

No 'Common' Door to Intercept

THE PROBLEM

Flat model: global /common endpoint enables issuer confusion

SECUREAUTH SOLUTION

Hierarchical model: unique dedicated endpoints per organization, context baked into URL

How SecureAuth Prevents This Attack

1

Isolation by Inheritance, Not Filtering

In a flat model, you are open by default and must write code to filter out the rest of the world. In SecureAuth's hierarchical model, you are isolated by default.

An application lives within a specific "branch" of the hierarchy. It only recognizes and trusts identity providers (IdPs) within its own lineage. An attacker spinning up a separate SecureAuth instance is effectively on a completely different "tree." There is no "common" endpoint that allows their branch to talk to yours unless you explicitly build a bridge between them.

2

Scope-Bound Administrative Roles

The Black Hat attack worked because the application trusted "Admin" roles defined in the attacker's tenant.

In SecureAuth's hierarchical structure, roles are scoped to the workspace. Even if an attacker manages to intercept a request, they cannot "spoof" a role that your application recognizes because the application is bound to a specific hierarchy level. It doesn't just ask "Is this person an admin?"—it asks "Is this person an admin within my specific workspace branch?"

3

No 'Common' Door to Intercept

The "Microsoft on Microsoft" attack relied heavily on the ability to swap a legitimate Tenant ID for a "common" ID during the login handshake.

SecureAuth doesn't use a global, shared "common" door for all users. Each hierarchy or organization has its own unique, dedicated endpoints. Because the "door" itself is specific to your organization's hierarchy, there is no generic endpoint for an attacker to redirect to. The "identity context" is baked into the URL and the hierarchy, leaving no room for the "issuer confusion" that Bernard exploited.

The Verdict: Architecture > Oversight

Microsoft's response to this research was to issue "best practices" telling developers to be more careful. But as any security professional knows, "be more careful" is not a security strategy.

The real takeaway from Black Hat is that your IAM architecture should protect your developers from making mistakes. By using Hierarchical Multi-Tenancy, SecureAuth ensures that even if a developer forgets to "validate the issuer," the system's own logical boundaries prevent a random outsider from ever being considered a valid user.

In the battle between a flat world and a hierarchical one, the hierarchy provides the walls that keep the "common" riff-raff out.

Key Architectural Advantage

SecureAuth's hierarchical model makes secure-by-default the norm. Developers don't need to remember to add security checks—the architecture enforces isolation automatically through workspace and realm boundaries.

Flat vs. Hierarchical: At a Glance

AspectFlat Model (Entra ID)Hierarchical (SecureAuth)
Default TrustTrust all Microsoft-signed tokensTrust only within workspace lineage
Role ValidationGlobal role claims acceptedRoles scoped to workspace branch
Authentication EndpointGlobal /common endpointUnique per-organization endpoints
Developer BurdenMust manually validate Tenant IDIsolation enforced by architecture
Attack SurfaceSingle oversight = full compromiseArchitectural boundaries prevent access

Ready to transform your identity security?

See how SecureAuth's Continuous Authority platform can protect your organization.

About SecureAuth

SecureAuth provides identity and access management solutions that enable enterprises to implement customized, resilient authentication infrastructure. Through Continuous Authority, flexible deployment options, and deep composable capabilities, SecureAuth helps organizations defend against modern identity threats while maintaining usability and operational efficiency.

Share this article: