---
id: 5933
title: "SMTP Matching Abuse in Azure AD"
source_domain: semperis.com
source_url: "https://www.semperis.com/blog/smtp-matching-abuse-in-azure-ad/"
published_at: "2022-08-30T00:01:02Z"
tags: ["cloud", "active-directory", "privilege-escalation", "research", "azure-ad", "hybrid-identity", "smtp-matching"]
phying_url: "https://phying.com/item/5933"
lang: en
---

# SMTP Matching Abuse in Azure AD

## Summary

Semperis research: anyone who can create AD accounts can abuse SMTP matching to reset Azure AD user passwords and, with prerequisites, gain privileged access via eligible role assignments.

## Intelligence Metadata

- **Sources:** semperis.com
- **Published:** 2022-08-30T00:01:02Z
- **Original:** https://www.semperis.com/blog/smtp-matching-abuse-in-azure-ad/
- **Phying News:** https://phying.com/item/5933