Emerging Attacker Exploit: Microsoft Cross-Tenant Synchronization by Arpan Sarkar

Vectra Research describes a new attack vector abusing Microsoft Cross-Tenant Synchronization (CTS) that allows an attacker with a compromised privileged account to synchronize a user from a compromised tenant into a target tenant (lateral movement) or deploy a rogue CTS configuration to maintain persistent access (backdoor). The report outlines assumptions, detailed attack steps for lateral movement and persistence, prerequisites (privileged roles and certain licenses), detection coverage by Vectra’s AI-driven detections, and recommends testing and monitoring using the MAAD Attack Framework to emulate and defend against these techniques.