Votre tenant Azure est-il sécurisé par défaut ?

Charles F. Hamilton, director of offensive security at CYPFER, walks through why an out-of-the-box Microsoft Entra ID (Azure) tenant is easier to compromise than most administrators assume. He opens with device code phishing: sending a legitimate Microsoft device-login link, capturing the code the victim enters, and receiving a token scoped to whatever application and resource the attacker requests, most often Microsoft Office or Microsoft Graph. He shows how default tenant settings let any standard user read other users' data, register applications, and consent to unverified third-party apps, then demonstrates hosting a look-alike application inside the victim's own tenant to dodge the 'unverified' warning. A live example covers a conditional access MFA exception, meant for one automation account, that silently exempts every Microsoft Graph request from MFA, a gap Microsoft patched in March 2026 but that still applies wherever the old exception was never updated. He also covers hunting leaked client secrets in GitHub history, pivoting refresh tokens across Microsoft's own applications without leaving log traces, and AI assistants surfacing passwords buried in SharePoint. He closes with hardening steps: disable device code flow, audit consented apps, review MFA exceptions, rotate exposed secrets, and revoke tokens once an attack is detected.