Microsoft 365 guest accounts + Power Apps = security nightmare

Microsoft 365 guest accounts aren't nearly as secure as Redmond would lead customers to believe, as low-code security expert Michael Bargury demonstrated at Black Hat. Guest accounts are commonly used by Microsoft shops to give non-employees access to their 365 tenancy with limited permissions, usually just access to a Teams …

[Scott 26]

Great. Looks like I have some work to do this morning - or at the least, tell my client's internal PA team, THEY have some work to do.

[thondwe]

Not just Guest accounts if you have a population of Students for example...

[Mungo Bung]

"Just stick students and staff in the same tenant - what could possibly go wrong?" *headdesk*

[MiguelC]

Re: "that shouldn't matter if a company is practicing good access management." That would be true, but it's here that Bargury's experience as co-founder and CTO of Zenity, a low-code/no-code security and governance platform, comes into play: he says many companies aren't.

That's where the problem lies, because if it wasn't PowerApps it would be something else.

[Claptrap314]

Who would have guest...

that a m$ product was insecure?