“The results surprised us: 25% of all the multi-tenant apps we scanned were vulnerable to authentication bypass.”
Azure’s login button checks that a token is valid, not who it belongs to. Any Azure user could log into a Bing content system, rewrite search results and launch XSS against Bing users’ Outlook mail and SharePoint files. Microsoft paid $40,000 and noted the services were outside the bounty scope. When Microsoft cannot configure Microsoft’s identity product, the quarter of customers who also got it wrong are not the problem.