Legacy Auth Endangers Cloud Identity

A researcher found two bugs in Microsoft Entra ID’s legacy authentication paths (ACS Actor Tokens and AAD Graph validation) that could let attackers impersonate any user across any Azure tenant. Microsoft patched the issue within days and reports no exploitation. The episode shows how old, deprecated endpoints can undermine security for entire cloud ecosystems. — It spotlights a systemic risk in cloud monocultures, arguing for aggressive legacy deprecation, external scrutiny, and incident‑ready governance for identity infrastructure.