alt Hacker NewsIf anyone from Microsoft security reads this, could you please do something about login.microsoftonline.com/XXX/v2.0/adminconsent?
The callback you're redirecting the user to at the end of that flow is forgeable if an attacker knows an azure tenant ID of a different customer, and putting a "Never use the tenant ID value of the tenant parameter to authenticate or authorize users" warning in the docs is only helpful as long as a way to authenticate users exists.
They'll see it, tell a manager, it'll get added as a ticket to an Azure Devops board under the initiative for this month under the epic for employee suggestions, which will be reviewed & prioritised by Copilot and sent to a different middle manager as a weekly summary email and then automatically closed when no human ever interacts with the ticket after three months.