Azure Survey 2025: 60 million Users and Counting

Azure Survey 2025: 60 million Users and Counting

Speakers: nyxgeek

Conference: ShmooCon

YouTube: https://www.youtube.com/watch?v=5YHcw-qj094

Overview

In his ShmooCon presentation, "Azure Survey 2025: 60 million Users and Counting," security researcher nyxgeek unveiled the extensive results of his multi-year project to enumerate valid Microsoft 365 users and monitor Microsoft employee presence. The talk detailed two primary components: a massive user enumeration effort via OneDrive, which has identified over 63 million unique users, and a Teams tracking initiative that monitored Microsoft employees for approximately six months. nyxgeek, a hacker at TrustedSec, critically examined Microsoft's stance on user enumeration, which the company does not consider a security flaw, arguing that this oversight creates a significant and easily exploitable attack surface.

The significance of nyxgeek's work lies in its demonstration of the sheer scale of publicly discoverable information within Microsoft's ecosystem. By leveraging publicly available data and Microsoft's own APIs, the project not only amassed a staggering list of valid user accounts but also exposed patterns in username creation, organizational structures, and even individual employee activity. This talk serves as a stark warning about the implications of widespread user enumeration for password sprays, phishing campaigns, and targeted attacks, especially given the homogeneous nature of the Azure attack surface relied upon by countless organizations and government entities globally.

Background

▶ Watch: Talk introduction and project scope (0:00)

The core premise of nyxgeek's research revolves around user enumeration, a technique where an attacker can determine whether a given username is valid within a system. While many security professionals consider this a fundamental flaw, as it significantly aids in pre-attack reconnaissance for password sprays and phishing attacks, Microsoft officially categorizes it as public information, akin to knowing a website's IP address. This position, which nyxgeek openly challenges, provided the impetus for his extensive project to demonstrate the real-world consequences of such a design decision.

Prior to this ShmooCon presentation, nyxgeek had already presented preliminary findings at Defcon about a year and a half earlier, where he had enumerated approximately 24 million users. The progression to over 63 million users by the time of this ShmooCon talk highlights the ongoing nature of the vulnerability and the continuous growth of Microsoft's user base. The problem exists because Microsoft's services, particularly OneDrive and certain APIs, provide distinct responses for valid versus invalid user accounts without requiring authentication. This subtle difference allows automated scripts to systematically test potential usernames and build vast lists of confirmed valid accounts, providing a critical initial step for adversaries to launch more sophisticated attacks.

Key Findings

▶ Watch: Project data, methods, and scale of enumeration (1:57)

nyxgeek's project yielded a wealth of data, illuminating various aspects of Microsoft 365's user landscape and organizational structure. His OneDrive surveys successfully enumerated over 63.3 million unique users, a substantial increase from his previous Defcon findings. This was achieved by scraping public data without any login attempts, solely identifying valid users and their real accounts. The project utilized around 40 machines over several years, accumulating 444,000 computer hours of scraping.

The research also identified 1.25 million live tenant domain combinations, with most organizations being relatively small. A significant finding was the continued reliance on ADFS (Active Directory Federation Services), used by approximately 42% of Fortune 500 companies, with Okta being the predominant provider among them. Analysis of TLDs (Top-Level Domains) by domain count and user numbers revealed that the .edu and .org domains hosted the majority of enumerated users.

Regarding username patterns, nyxgeek found an average of 59,000 new users identified per day. The list represents about 15% of the estimated 400 million total M365 users. Surprisingly, "info" was the most common top username found, followed by typical first-initial-lastname or firstname-lastname formats. The study also differentiated between normal user accounts and service accounts, highlighting common patterns like "admin" or "administrator." An intriguing discovery was the presence of krbtgt accounts, often associated with Active Directory Kerberos Ticket Granting Tickets, in the enumerated list, suggesting potential misconfigurations or unique naming conventions.

For users who need to append numbers to their usernames due to name collisions, "2" was by far the most common appendage. Numeric usernames constituted approximately 12% of all accounts found, with six-digit numerical sequences being the most prevalent. The distribution of these numeric usernames was observed to be non-random, appearing in distinct spikes. A comparison of nyxgeek's "tontastic username list" with the known Sock Radar data dump revealed interesting overlaps and divergences, providing insights into common naming conventions across different datasets.

Technical Deep Dive

▶ Watch: Analysis of top usernames and service accounts (4:09)

The technical methodology behind nyxgeek's user enumeration hinged on exploiting public-facing aspects of Microsoft's services, primarily OneDrive. The process involved web scraping without any authentication attempts, relying on the distinct responses received from OneDrive when querying for valid versus invalid usernames. This technique allowed for the passive identification of real, active user accounts, avoiding duplicates. Two specific Microsoft APIs were instrumental in augmenting this process: one API helped determine if a domain was managed or using ADFS, and the Autodiscover API, which, when queried with a single domain, could return information for up to 297 related domains, significantly accelerating domain discovery.

For the Teams tracking component, nyxgeek initially leveraged a flaw in Microsoft Teams that allowed anonymous users to check the presence status (online, busy, away) of any user. This feature, which had been enabled by default since 2014, allowed researchers to identify user availability, even detecting company-wide events based on synchronized "busy" statuses. nyxgeek had previously released a tool demonstrating this at Defcon. Microsoft responded swiftly to this public disclosure, fixing the anonymous access vulnerability within 24 hours. However, the fix wasn't a complete removal of the functionality; instead, Microsoft made it so that a valid license was required to perform presence enumeration, effectively monetizing access to this information rather than eliminating the underlying capability.

In response to Microsoft's "fix," nyxgeek developed and announced Team Tracker 2.0, rebranded as ICU for Teams. This new iteration is designed as a self-hosted solution, allowing users with valid M365 licenses to conduct their own data mining and presence monitoring. The tool provides a front-end interface to visualize availability data, generate monthly heatmaps of user activity, and, crucially, farm out-of-office (OOO) replies. nyxgeek demonstrated the power of this by collecting 52,000 OOO messages from Microsoft employees alone. The architectural shift from anonymous public access to a licensed, self-hosted model underscores the persistent nature of the information leakage, even after a vendor-implemented "fix."

Demo / Proof of Concept

▶ Watch: Uncovering strange krbtgt account findings (4:50)

The "Demo / Proof of Concept" section of nyxgeek's talk primarily showcased the capabilities of his new tool, ICU for Teams, which is the successor to his earlier Teams presence enumeration tool. While not a live demonstration during the talk, nyxgeek presented numerous screenshots and data visualizations derived from his extensive monitoring efforts.

ICU for Teams is presented as a self-hosted solution for M365 analytics. Its key functionalities include:

• Availability Monitoring: The tool can track the online/offline status of targeted users, providing insights into their work patterns.
• Monthly Heat Maps: Visualizations show user activity across days and hours, revealing peak work times and periods of inactivity. For instance, nyxgeek's data showed that most people return to work on Mondays.
• Out-of-Office (OOO) Reply Farming: A significant capability is the automated collection of OOO messages. nyxgeek highlighted that he had amassed 52,000 OOO replies from Microsoft employees alone. These messages, often containing personal details, travel plans, or internal company information, can be parsed for keywords, sentiment analysis (though nyxgeek noted he hadn't fully implemented sentiment analysis yet), and common phrases ("hellos and goodbyes," "thank yous and pleases").
• Trend Analysis: The collected OOO data allows for the identification of company-wide events or holidays. For example, visualizations clearly showed spikes in OOO messages around July 4th and Labor Day, with a subsequent drop as employees returned.
• Individual Activity Tracking: The tool can be used to monitor specific high-value targets. nyxgeek humorously showed data for Microsoft CEO Satya Nadella, indicating his most active hours (between 03:00 and 05:00 UTC). He also highlighted an employee, Kathleen, with a good work-life balance (offline half the time), contrasting with Satya who appeared "always available." Another intriguing example was an individual named "Nick Carr" whose message status was "kicking ass 24/7."
• External Access Identification: The tool can detect users who have enabled external access for Teams, potentially allowing communication with individuals outside their organization. nyxgeek pointed out high-profile figures like Mark Cuban, suggesting that this could be an avenue for unexpected interactions or pitches.

The overall proof of concept demonstrated that even with Microsoft's "fix" requiring a license, the ability to gather extensive intelligence on users, their activity patterns, and internal communications through OOO messages remains readily accessible to an organization (or an attacker with a single licensed account).

Defensive Implications

▶ Watch: Comparing enumerated usernames to Sock Radar data (6:12)

nyxgeek's research carries profound defensive implications for organizations leveraging Microsoft 365 and Azure, as well as for national security. The primary concern is the continued ease of user enumeration, which Microsoft inexplicably does not classify as a vulnerability. This stance directly enables attackers to perform highly effective password sprays and phishing campaigns by pre-validating usernames, significantly reducing the effort and increasing the success rate of such attacks.

The speaker highlighted a critical geopolitical risk: the creation of a homogeneous attack surface. With a vast majority of Western organizations, including government entities and critical infrastructure, relying on Azure and Microsoft 365, adversaries can focus their efforts on a single, ubiquitous platform. This concentration of targets simplifies reconnaissance and attack development for state-sponsored actors, as they don't need to develop diverse attack methods for disparate systems. Conversely, Microsoft's allies are all exposed to the same vulnerabilities, while adversaries often operate on different, less centralized platforms. nyxgeek starkly described this as "an adversary's dream," allowing them to build targeted lists of individuals for cyber warfare scenarios.

To mitigate these risks, nyxgeek proposed several "easy wins" for Microsoft:

1. Disable User Enumeration: The most straightforward and impactful change would be to make it impossible for unauthenticated or unauthorized users to differentiate between valid and invalid usernames. This would significantly hinder initial reconnaissance phases for attackers.
2. Stop Charging More for Extra Security: nyxgeek criticized Microsoft for often placing enhanced security features behind higher-tier licenses. He argued that critical security capabilities should be universally available to all users by default, not as an upsell.
3. Make the Defaults More Secure: Beyond specific features, the default configurations of Microsoft 365 services should prioritize security over convenience. This includes settings related to presence visibility and external access.
4. Invest More in Security: Given Microsoft's immense profitability, nyxgeek asserted that the company should allocate substantially more resources to security research, vulnerability remediation, and proactive defense. He pointed to the consistent number of CVEs submitted annually as evidence that current investment is insufficient, particularly when compared to the global reliance on their platforms.

In essence, the defensive takeaway is that organizations must understand that user enumeration is a feature, not a bug, in Microsoft's eyes, and thus they cannot rely solely on Microsoft to fix this fundamental exposure. They must implement robust multi-factor authentication, strong password policies, and advanced phishing detection mechanisms, assuming that adversaries will always have access to valid username lists. Furthermore, organizations should review their Teams presence settings and out-of-office message policies to minimize inadvertent information leakage.

Key Takeaways

• Massive User Enumeration: Over 63 million valid Microsoft 365 users have been enumerated via public OneDrive surveys, demonstrating the pervasive nature of this information leakage.
• Microsoft's Stance Creates Risk: Microsoft does not consider user enumeration a security flaw, enabling attackers to conduct effective password sprays and phishing campaigns against a pre-validated user base.
• Teams Presence Monitoring is Possible: Even after Microsoft's "fix" requiring a license, tools like ICU for Teams allow organizations to monitor user availability, generate activity heatmaps, and collect tens of thousands of out-of-office replies, revealing sensitive internal information.
• Homogeneous Attack Surface: The widespread adoption of Azure and Microsoft 365 creates a centralized, homogeneous attack surface that is highly attractive and efficient for sophisticated adversaries to target.
• Actionable Defensive Steps for Microsoft: Microsoft should disable user enumeration, make essential security features universally available, prioritize secure defaults, and significantly increase investment in platform security.
• Organizational Responsibility: Defenders must assume user enumeration is possible and implement robust security controls like MFA, strong password policies, and careful management of public-facing information.

About the Speaker(s)

The talk was delivered by nyxgeek, who is identified as a hacker at TrustedSec. His presentation at ShmooCon built upon previous research he had presented at Defcon, showcasing his ongoing work in identifying and quantifying user enumeration vulnerabilities within large platforms like Microsoft 365. nyxgeek is also the developer behind the tools used in this research, including the earlier Teams presence monitoring tool and its successor, ICU for Teams. His GitHub repository is expected to host the data and tools discussed in the talk.