Unwelcome Guest: Abusing Azure Guest Access to Dump…

This report demonstrates a reconnaissance technique against Azure AD tenants where a guest account (with default external collaboration settings) can programmatically enumerate users, groups, group memberships, and applications by discovering ObjectIds and using PowerShell and Microsoft Graph calls; the author provides a proof-of-concept script, discusses attack methodology and automation, and recommends restricting guest permissions as remediation.