“Not only could Microsoft lose a multibillion-dollar deal, but it could also lose the race to dominate the market for cloud computing.”
Andrew Harris found the SAML flaw in 2016 and offered a stopgap: tell customers to turn off seamless single sign-on. Microsoft said no because it would annoy the federal government, threaten a multibillion-dollar Pentagon contract and erase a “kill point” over Okta. Russian hackers later used the same flaw to get into the National Nuclear Security Administration and NIH. The customer paid for that sales advantage with its nuclear secrets.