Although DACL permissions are not the easiest topic to cover in one post and should be digested slowly, there are examples of potential attack scenarios we want to share. The following blog tries to shed some light on the subject, present the possible escalation paths and suggest relevant mitigations.
Microsoft’s announcement that the Exchange Hybrid Configuration Wizard (HCW) is now able to transfer some configuration settings from an Exchange on-premises organization to Exchange Online came as a disappointment. Not because of the functionality, which is welcome, but because it is limited and far too late. Continue reading → Hybrid Configuration Wizard Transfers Settings – Sorry bit late now