The last decade has seen an increase push in what Google started calling "Zero Trust"[0] and dropping VPNs entirely. The issue being that once someone got into a VPN it was much, much harder to prevent them from accessing important data.

So everything "internal" is now also external and required to have its own layer of permissions and the like, making it much harder for, e.g. the article, to use one exploit to access another service.

[0] https://cloud.google.com/learn/what-is-zero-trust

> Move to the cloud they said. It will be more secure then your intranet they said. Only fools pay for their own Ops team they said.

It seems that the fundamental issue surfaced in the blog post is that developers who work on authorizarion in resource servers are failing to check basic claims in tokens such as the issuer, the audience, and subject.

If your developers are behind this gross oversight, do you honestly expect an intranet to make a difference?

Listen, the underlying issue is not cloud vs self-hosted. The underlying issue is that security is hard and in general there is no feedback loop except security incidents. Placing your apps in a intranet, or VPN, does nothing to mitigate this issue.

For me, I don't think that the application is public exposed is really the problem (i.e. not in intranet).

I think the real problem is that these applications (Entra ID) are multi-tenant, rather than a dedicated single-tenant instance.

Here, we have critical identity information that is being stored and shared in the same database with other tenants (malicious attackers). This makes multi-tenancy violations common. Even if Entra ID had a robust mechanism to perform tenancy checks i.e. object belongs to some tenant, there are still vulnerabilities. For example, as you saw in the blog post, multi-tenant requests (requests that span >= 2 tenants), are fundamentally difficult to authorize. A single mistake, can lead to complete compromise.

Compare this to a single tenant app. First, the attacker would need to be authenticated as an user within your tenant. This makes pre-auth attacks more difficult.

I guess the term "defense in depth" has fallen out of fashion?

That is probably still good advice for most companies. Joe's roof fixing business may be the best roof fixing business in 3 states, but would you want them to run their own server for their website, email, and booking?

Anyone who is on this forum is capable of building their own stuff, and running their own server, but that is not most people.