Microsoft Entra Billing Roles Vulnerability Could Enable Privilege Escalation in Organizations

A billing-permissions issue in Microsoft Azure / Entra ID allows guest users who hold Enterprise Agreement or Microsoft Customer Agreement billing roles to create and transfer subscriptions into tenants where they are guests, automatically gaining Owner-level access. This access enables enumeration of privileged accounts, modification or disabling of policies, creation of user-managed identities (potential persistent backdoors), and registration of Azure-joined devices; Microsoft characterizes the behavior as expected and published subscription policy controls, while BeyondTrust recommends auditing guests and enabling restrictive subscription policies.