Microsoft Entra Gap Lets Guest Users Inject Subscriptions into Target Tenants

A security risk in Microsoft Entra's subscription management has raised concerns following a detailed investigation by The Hacker News. The issue involves a gap in access controls that permits guest users, once invited into an external Entra tenant—to create and transfer subscriptions into that tenant while maintaining full ownership of them. As explained by The Hacker News, “A gap in access control in Microsoft Entra's subscription handling is allowing guest users to create and transfer subscriptions into the tenant they are invited into, while maintaining full ownership of them.” This capability effectively enables guest accounts, typically considered low-risk, to gain privileged footholds and perform actions far beyond their expected scope. The risk is compounded by the way Microsoft scopes billing permissions: “Guest-made subscription footholds exploit the fact that Microsoft's billing permissions (Enterprise Agreement or Microsoft Customer Agreement) are scoped at the billing account, not the Entra directory,” The Hacker News further clarifies. This oversight in security modeling creates conditions for unauthorized activity that may not be detected using conventional auditing practices focused solely on Entra Directory or Azure RBAC roles.

The outlined attack chain shows how a malicious actor can escalate access from a non-privileged position using an Entra guest account. First, the attacker must control/acquire an account with a billing role capable of creating subscriptions, either by signing up for a free Azure trial or compromising an existing user. The attacker then sends an invitation to join the target Entra tenant as a guest. Once invited, the attacker leverages their home tenant’s portal to create a subscription, but configures it to reside within the defender's tenant. Although created externally, the subscription is injected under the defender's root management group, with the attacker automatically granted “Owner” privileges. This process occurs entirely outside the visibility of the target tenant’s standard role and permission monitoring, creating a blind spot for defenders.

With full ownership of a subscription inside the victim’s environment, the attacker can conduct several high-risk activities. These include enumerating administrative users inherited from root-level management groups, modifying or disabling Azure policy enforcement to suppress alerts, and creating user-managed identities that persist beyond the guest account's lifecycle. Such identities may be used to bypass restrictions or phish for additional privileges. Additionally, attackers can register Entra-joined devices that appear compliant, taking advantage of conditional access rules based on device trust. This grants the attacker access to corporate resources that would typically be off-limits to guest accounts. These activities not only permit persistence but can also serve as launching points for further lateral movement and privilege escalation within the tenant.

The core danger lies in the stealth and scope of the intrusion. As The Hacker News warns, “Typical threat models and best practices don't account for an unprivileged guest creating their own subscription within your tenant, so this risk may not only exist outside your organization's controls; it may be off your security team's radar as well.” Mitigating this risk requires a combination of subscription policy restrictions and administrative diligence. Organizations should enable policies that block guests from transferring subscriptions into their tenant, disable guest-to-guest invitations, and audit both guest accounts and subscription ownership regularly. Monitoring should extend to devices and dynamic access group configurations, which could be manipulated for unauthorized access. These measures are essential to closing a threat path that is currently being exploited in the wild and remains under-recognized in most Entra security models.