“In addition to the overly permissive access scope, the token was also misconfigured to allow “full control” permissions instead of read-only.”
Microsoft researchers shared an image model on GitHub with an Azure SAS link that unlocked the whole storage account. That meant 38TB, two workstation backups, passwords, keys and 30,000 Teams messages from 359 employees. The token sat public from July 2020, and someone extended its expiry to 2051. Azure gives admins no central way to even see these tokens exist. Microsoft built a sharing feature it can’t audit and then leaked its own staff with it.