Microsoft Fixes Azure Automation Flaw that Could Enable Cross-Tenant Access

Microsoft has addressed a critical vulnerability in Microsoft Azure Automation. This security flaw could allow attackers to gain elevated privileges and potentially access resources belonging to other Azure tenants.

Azure Automation is a cloud service that helps organizations automate repetitive IT and operational tasks without requiring constant manual intervention. It enables teams to create and run automated workflows, known as runbooks, for activities such as deploying resources, managing configurations, applying updates, rotating credentials, and orchestrating processes across Azure and hybrid environments.

Last year, this vulnerability (tracked as CVE-2025-29827) was discovered by Microsoft security researcher Shay Shavit, who reported it through the Microsoft Security Response Center (MSRC). This flaw carries a CVSS score of 9.9, and it can be exploited remotely, requires only low-level privileges, and does not depend on user interaction.

How does the Azure Automation vulnerability work?

CVE-2025-29827 is a critical privilege-escalation vulnerability in Microsoft Azure Automation that stems from weaknesses in how the service validates and enforces access permissions. While an attacker would need legitimate access to an Azure Automation account, the flaw could allow them to move beyond their intended level of authorization and gain control over identities with greater privileges. Azure Automation often manages sensitive administrative tasks, and such elevated access could provide a pathway to important cloud resources, automation workflows, and protected configuration data.

Researchers found that this vulnerability could be combined with a risky default configuration and other application flaws to cross trust boundaries between Azure tenants. In a successful attack scenario, a malicious user could potentially impersonate another organization’s automation identity, which enables unauthorized access to credentials, automated processes, and cloud assets.

Best practices to secure Azure Automation environments

Microsoft’s recommendation is to ensure that Azure Automation environments are running with the latest security updates and remediation measures. The company has already addressed the underlying authorization flaw and modified the default configuration that contributed to the risk. Organizations should review their Azure Automation deployments to confirm that security fixes have been applied and that automation accounts are configured according to current security best practices.

Microsoft also emphasized the importance of following the principle of least privilege. Administrators should regularly audit the managed identities, permissions, and access tokens associated with automation accounts to ensure they have only the rights required to perform their intended functions. Moreover, they should avoid unnecessarily exposing cloud services or endpoints to external access and continuously monitor for misconfigurations that could be combined with other weaknesses to create larger attack paths.