Behind The Breach: Self-Service Password Reset (SSPR) Abuse in Azure AD

Originally published by Obsidian Security.In several recent investigations of SaaS security incidents, the Obsidian threat research team identified a novel attack vector in the wild: abuse of the Azure AD self-service password reset (SSPR) feature.With the glaring lack of coverage around this specific threat vector, our team felt it would be an important topic for discussion. In this blog, we’ll explore the self-service password reset technique in more detail, share some firsthand examples fr...

abuse attack attack vector azure azure ad breach feature incidents investigations novel obsidian obsidian security password password reset research reset saas saas security security service team threat threat research threat vector