Microsoft traces cloud breach to one hijacked identity

Microsoft has published a post-incident breakdown of how a single compromised cloud identity cascaded into a multi-tenant breach affecting its broader Azure and Entra ID infrastructure. The attack chain exploited over-privileged admin accounts that had never been scoped down, combined with legacy authentication endpoints that remained active despite serving no operational purpose. The entry point was a misconfigured Entra ID environment. Once attackers had the initial foothold, lateral movement across tenants was possible because administrative roles carried permissions far exceeding what any single function required. Legacy auth protocols bypassed conditional access policies entirely, giving attackers a path that modern MFA controls couldn't intercept. Essentially: (Microsoft, enterprise Azure customers) are contending with a class of misconfiguration that has appeared in multiple 2026 campaigns, suggesting coordinated exploitation of known Entra ID weaknesses rather than novel zero-days. - Entra ID misconfiguration, specifically over-privileged admin accounts, is named as the primary breach enabler. - Legacy authentication endpoints that bypass conditional access were the lateral movement pathway. - Microsoft's own post-mortem identifies this pattern across multiple 2026 incidents, not as a one-off. The breach illustrates that cloud identity hygiene, not endpoint security or perimeter defenses, is now the dominant attack surface in enterprise infrastructure.