Topic starter
20/08/2026 5:26 pm
TL;DR: Microsoft’s Get-FederationInformation change broke unauthenticated tenant enumeration through Autodiscover, but alternate endpoints and database-driven workarounds can still preserve the technique for offensive workflows, according to Sprocket Security. The deeper lesson is that identity discovery controls are often easier to bypass than they first appear, so exposure management has to account for fallback paths, not just the primary endpoint.
Editorial analysis by NHI Mgmt Group, based on content published by Sprocket Security: “Tenant Enumeration is Back”.
Key questions
A: The primary break is false confidence.
Q: Why does tenant enumeration still matter after a patch closes the obvious endpoint?
A: Because discovery is often a prerequisite for later targeting.
Q: What signs suggest tenant discovery controls are failing in practice?
A: Look for repeated domain lookups, unusual use of identity discovery endpoints, and requests that probe multiple related domains in short bursts.
Practitioner guidance
- Map every tenant metadata surface Inventory Autodiscover, OIDC discovery, user-realm lookups, and any other Microsoft identity endpoints that return tenant names, domain sets, or federation details.
- Reduce identifier reuse across workflows Limit where tenant names and verified domains are exposed in documentation, tooling, and automation so one lookup does not cascade into later enumeration steps.
- Test fallback enumeration paths Validate whether alternate endpoints, cached datasets, or proxy services can still recover tenant metadata after the primary path is blocked.
Bottom line: Microsoft’s patch reduced one unauthenticated tenant-enumeration path, but it did not eliminate the broader discovery problem because alternate resolvers still exist.
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
20/08/2026 6:15 pm
Tenant discovery controls fail when they are treated as single-endpoint problems. The article shows a classic control displacement pattern: Microsoft constrained one Autodiscover behaviour, yet alternate interfaces and offline datasets still let operators reconstruct the same tenant intelligence. That means the real governance unit is the full metadata surface, not the individual request path. Practitioners should treat tenant enumeration as an exposure class, not a one-off bug fix.
A question worth separating out:
Q: How should teams respond when a tenant lookup technique is replaced by a fallback service?
A: Treat the fallback as part of the same exposure, not a separate issue. Remove or restrict redundant metadata returns, validate whether the alternative service exposes the same tenant intelligence, and reassess whether the original patch actually reduced attacker reach. Governance should follow the data, not the interface name.
👉 Read our full editorial: Tenant enumeration after Microsoft’s patch: what changed for practitioners