Huntress Demo Escalates a Standard Microsoft 365 User to Global Admin in Five Minutes
Summary
A Huntress demonstration escalated a standard Microsoft 365 account to Global Admin in five and a half minutes by exploiting excessive application permissions. In a 12,000-tenant review, common gaps included weak MFA and over-privileged users.
Key points
- In a live demonstration, a standard account became a Global Admin after its operator found an over-privileged service account, created an application credential, and ran an AI-assisted script.
- Huntress said its Early Access program covered more than 12,000 Microsoft 365 tenants; over 60% lacked at least half of its recommended security controls.
- The review found that 66% of tenants lacked recommended MFA configurations, 55% allowed standard users to perform admin-level functions, and 59% had insufficiently restricted admin accounts.
- Huntress cites fear of user disruption, persistent exceptions, configuration drift, and inherited tenant weaknesses as reasons security controls remain incomplete.
- The company says its Managed ISPM service detects and remediates identity configuration drift, guides policy deployments, and feeds findings from its identity threat detection service into hardening.
Article Details
- Event Type
- Huntress security demonstration and identity-security posture assessment
- Impact
- A live demonstration showed a fictional standard Microsoft 365 user escalating to Global Admin in five and a half minutes by exploiting an overprivileged enterprise application and creating a credential. In Huntress’s Early Access assessment across more than 12,000 Microsoft 365 tenants, over 60% were missing at least half of Huntress-recommended controls; 66% lacked recommended MFA configurations, 55% allowed standard users to perform admin-level functions, and 59% had insufficiently restricted admin accounts. Huntress estimates that approximately 35% of identity-based incidents its ITDR SOC handled over the previous six months could have been prevented with fully deployed ISPM policies, and expects that figure to reach 80% as additional controls are added.
People
Vendors
HuntressIn front of a live audience during our launch event, Huntress Principal Product Manager Scott Riley built a fictional Microsoft 365 user he called "Standard Steve"—a regular account with no admin access, representingMicrosoftWe spent three months assessing how Microsoft 365 environments actually get compromised. What we found should change how you think about identity hardening.
Products
Conditional AccessFear of user impact keeps controls from going live. Rolling out a Conditional Access policy means someone might get locked out, workflows might break, or the helpdesk gets flooded. The safer choice is to wait untilManaged Identity Threat Detection and Response (ITDR)for identity resilience. When our SOC detects an active identity threat through Managed Identity Threat Detection and Response (ITDR), those findings feed directly into ISPM to close the specific gaps that made theManaged ISPMWhen we catch drift in Managed ISPM, we detect and remediate it in minutes. That gap—15 minutes versus 24 hours—is the difference between an attacker finding a closed door and finding an open one.Microsoft 365 Apps for EnterpriseWe spent three months assessing how Microsoft 365 environments actually get compromised. What we found should change how you think about identity hardening.