Azure Automation Default Setting Exposes Cross‑Tenant Identity Takeover Risk
What Happened — A publicly‑enabled default configuration in Azure Automation, combined with a chain of code flaws, could allow an attacker to assume the identity of a different Azure tenant and access that tenant’s data, credentials, and workloads. Microsoft has issued a fix that removes the default setting and patches the underlying code issues.
Why It Matters for Compliance & Audit Readiness
- Cross‑tenant identity takeover is a classic control‑gap scenario that SOC 2’s Change Management (CC6.1) and System Operations (CC7.1) controls are designed to prevent and evidence.
- Continuous configuration monitoring and immutable audit trails are required to prove that default, insecure settings are identified, remediated, and never re‑introduced.
- Verisq’s Control Mapping capability lets you map the Azure Automation setting to the relevant SOC 2 controls and automatically collect evidence of remediation for audit reviewers.
Who Is Affected — Cloud service providers, SaaS vendors, and any organization that runs workloads in Azure Automation (primarily CLOUD_INFRA and CLOUD_HOST sectors).
Recommended Actions
- Immediately audit Azure Automation accounts for the default “Runbook Worker” setting and disable it if present.
- Apply Microsoft’s latest security patches for Azure Automation (see KB link).
- Map the configuration change to SOC 2 CC6.1 and CC7.1 controls in your compliance framework and capture remediation evidence in a trusted repository.
- Enable continuous configuration monitoring (e.g., Azure Policy, Azure Security Center) to detect any re‑introduction of insecure defaults.
Source: Dark Reading – Default Azure Automation Setting Enables Cross‑Tenant Identity Takeover
Technical Notes — The issue stems from a default‑on “Hybrid Runbook Worker” configuration that trusts any Azure AD tenant, combined with insufficient input validation in the Automation service code (multiple CVE‑style flaws disclosed by Microsoft). Exploitation would allow credential harvesting and lateral movement across tenant boundaries.