nOAuth

Descope identified a possible misconfiguration in Azure AD which could lead to misuse of the "Log in with Microsoft"
authentication method on a web app. If an application relies on email attribute claims for authentication (which is
against best practice) and also merges user accounts without proper validation, an attacker could falsify an email
claim to gain full control over the target account. Descope and Microsoft Microsoft identified several popular multi-tenant
applications with users that used an email address with …

accounts app application authentication azure azure ad best practice claim claims control email log microsoft misconfiguration noauth practice validation web web app