Azure Survey 60 million Users & Counting

The speaker, a hacker at TrustedSec, presents research on user enumeration in Microsoft Azure and Microsoft 365. User enumeration lets an attacker confirm which usernames are valid, which makes password spraying and phishing easier. Microsoft does not treat this as a vulnerability and describes the information as public. The talk has two parts: a long-running OneDrive-based survey that has identified about 63 million users, and roughly six months of monitoring Teams presence data for Microsoft staff.

The survey relies only on web scraping, with no login attempts, and draws on public data sources and Microsoft discovery endpoints. Reported findings include about 1.25 million live tenant and domain combinations, ADFS use by around 42 percent of Fortune 500 companies, and common username formats such as first initial plus surname. Numeric suffixes make up about 12 percent of usernames. The Teams work uses presence enumeration, which has been enabled by default since 2014. The speaker showed how availability data can reveal calendar busy times, and collected around 52,000 out-of-office replies. A self-hosted successor tool was announced.

The speaker argues that a homogeneous cloud platform gives adversaries one concentrated attack surface, and that bug bounties are unlikely to surface serious flaws of that kind. The recommendations are for Microsoft to disable user enumeration, stop charging for security features that should be standard, and make secure defaults the norm. For defenders, the practical takeaway is to check how much tenant discovery and presence exposure their own organisation already leaves visible.