Topic starter
18/08/2026 2:23 pm
TL;DR: Microsoft has patched the main unauthenticated paths for tenant domain enumeration, including the ACS metadata endpoint and Autodiscover federation queries, but practitioners can still recover tenant IDs, MOERA prefixes, and related domains through DNS, Graph, and OpenID-based techniques according to Sprocket Security. The real issue is that identity discovery has shifted from single-request enumeration to fragmented recon across multiple identity surfaces, which raises the bar for both defenders and offensive tooling.
Editorial analysis by NHI Mgmt Group, based on content published by Sprocket Security: “Tenant Enumeration is Dead”.
Key questions
Q: What breaks when unauthenticated Microsoft tenant enumeration is patched?
A: What breaks is the single-request workflow that returned every verified domain in a tenant.
Q: Why do tenant IDs and MOERA prefixes still matter after patching?
A: Tenant IDs and MOERA prefixes still matter because they are the keys that make downstream Microsoft 365 discovery useful.
Q: How can security teams tell whether identity discovery is still leaking?
A: Look for exposed DKIM CNAMEs, predictable MX answers, tenant ID resolution through public OpenID endpoints, and repeated authenticated or unauthenticated lookup activity across Microsoft identity surfaces.
Practitioner guidance
- Audit public identity disclosure surfaces Inventory DNS, DKIM, OpenID configuration, federation metadata, and related Microsoft 365 endpoints that can reveal tenant identity fragments or naming conventions.
- Review cross-tenant lookup permissions Limit permissions such as CrossTenantInformation.ReadBasic.All to the smallest set of approved applications and monitor any usage patterns that resemble broad tenant reconnaissance.
- Validate tenant-name exposure paths Check whether your organization still publishes DKIM CNAMEs, MX records, or other records that can reveal the MOERA prefix or related domains.
Bottom line: Microsoft has removed the highest-yield unauthenticated tenant enumeration paths, but identity discovery has not disappeared, it has fragmented across public records and lookup services.
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
18/08/2026 3:14 pm
Tenant discovery has become a correlation problem, not a single-endpoint problem. The old model assumed one unauthenticated request could disclose the tenant’s domain surface. That assumption is gone, but the operational value of tenant intelligence remains because the fragments still exist across DNS, OpenID, and authenticated directory queries. Practitioners should now think in terms of distributed identity exposure rather than endpoint hardening alone.
A question worth separating out:
Q: When should teams treat a lookup API as a reconnaissance risk?
A: Treat a lookup API as a reconnaissance risk whenever it can be used to resolve tenant information, cross-tenant relationships, or naming data at scale. Even authenticated APIs can support abuse if permissions are broad, automation is easy, and the output materially helps tenant mapping or phishing preparation.
👉 Read our full editorial: Microsoft tenant enumeration is ending, but domain discovery remains