---
date: 2023-08-10
description: In a recent Black Hat presentation, Michael Bargury unveiled vulnerabilities
  in Microsoft 365's guest accounts, exposing potential exploits in Power Apps. Guest
  accounts can circumvent restrictions using trial licenses, enabling attackers to
  access and manipulate internal applications and databases, including sensitive data.
  Bargury demonstrated his tool, Powerpwn, which accesses Azure SQL databases, highlighting
  user negligence in access management and credential embedding as critical risk factors.
  While Microsoft is addressing these gaps, organizations must enforce stricter access
  controls to mitigate risks associated with low-code platforms. Effective governance
  is essential to safeguard internal data against guest account misuse.
link: /archive/2023-08-10-microsoft-365-guests-power-apps-security-nightmare-the-register
tags:
- Power Apps
- Microsoft 365
- Cybersecurity
- Guest Accounts
- Data Loss Prevention
- weblog
title: "Microsoft 365 guests + Power Apps = security nightmare \u2022 The Register"
type: weblog
---
{% raw %}

A login, a PA trial license, and some good old hacking are all that's needed to nab SQL databases
{% endraw %}