Azure Automation’s default identity exposure let a valid account cross a trust boundary and act with another tenant’s managed identity. The standard view of this as an automation bug misses the larger problem: once that identity is taken over, the attacker can inherit the privileges behind runbooks and move from one account into cloud control and sensitive secrets.
Microsoft fixed CVE-2025-29827 after researchers found that the account identity endpoint was publicly reachable by default. With an ordinary Azure Automation account, an attacker could assume another tenant’s automation identity and then create, modify, or delete resources, or read configuration data and credentials tied to that identity.
The practical risk is broader than one misconfigured automation account. In environments that use Azure Automation for deployment, patching, or secret rotation, a compromised identity can become a standing control path into the workloads it is trusted to manage.