---
date: 2023-07-14
description: A new vulnerability reported by Michael Bargury at Black Hat USA reveals
  how improperly configured Azure AD guest accounts and over-permissive Power Apps
  connections can lead to unauthorized data access. By manipulating default settings,
  malicious actors can access sensitive corporate applications and data sources. Bargury's
  two-step attack demonstrates how guest accounts can leverage undocumented APIs to
  bypass Standard Data Loss Prevention mechanisms. To defend against these risks,
  he recommends auditing guest access configurations and using the newly introduced
  PowerGuest tool to limit exposure and detect misconfigurations effectively.
link: /archive/2023-07-14-rogue-azure-ad-guests-can-steal-data-via-power-apps
tags:
- Azure AD
- Data Protection
- Power Apps
- Cybersecurity Risks
- Application Security
- weblog
title: Rogue Azure AD Guests Can Steal Data via Power Apps
type: weblog
---
{% raw %}

A few default guest setting manipulations in Azure AD and over-promiscuous low-code app developer connections can upend data protections.

{% endraw %}