Security teams learned years ago that an expired domain is a liability. Let one lapse and someone else can register it, receive email meant for you and borrow your reputation. This week Microsoft described a criminal operation that applied the same idea to Microsoft 365 tenants, and built a business on it.
In its report on Storm-3119, published on 14 October alongside a disruption by its Digital Crimes Unit, Microsoft says the group used automation to find expired environment and organisation names and reused legitimate customer information tied to them. It hijacked education and non-profit tenants, took control through Global Administrator accounts and app credentials, and resold the accounts, licences and storage to phishing operators. Phishing pages ended up hosted in other organisations' SharePoint and OneDrive.
We've covered the technical side and the hunting queries in Your Tenant, Their Storefront. This post is about the governance problem underneath it: most organisations have more tenants than they think, and nobody owns the old ones.
How organisations end up with tenants nobody watches
Tenants are easy to create and nobody remembers to close them. The usual sources are:
- Trials. Someone signs up for a Microsoft 365 or Azure trial to test something, and a new tenant appears with them as its Global Administrator.
- Projects and proofs of concept. A separate tenant for a pilot, a migration rehearsal or a supplier's demo environment.
- Acquisitions. The acquired company's tenant is meant to be migrated and retired, but the migration stalls, or finishes without the old tenant being shut down.
- Subsidiaries, charities and joint ventures. Related organisations with their own tenant, managed by whoever happened to set it up.
- Self-service sign-ups. Users signing up for Microsoft services with a work address can create unmanaged directories that IT never sees.
None of these is unusual. What turns them into a risk is the same thing that turns a lapsed domain into one: nobody is looking.
Why a forgotten tenant is worth stealing
A forgotten tenant has the things an attacker wants and none of the things that would stop them.
- A real reputation. Its domains, its SharePoint and its mail come from a genuine organisation with history, which helps phishing get through filters that check reputation.
- Free hosting and licences. Storage, mailboxes and licences that someone is still paying for, or that came with an education or non-profit offer.
- Weak administrators. The Global Administrator is often the person who created the trial, maybe with a password set years ago and no MFA, or someone who has since left.
- No one reading the logs. The tenant isn't connected to your SIEM, isn't in your Conditional Access baseline and doesn't appear in anyone's monitoring.
- A link back to you. If it was created by your staff, linked to your domains or trusted by your main tenant through guest access or cross-tenant settings, a takeover can be a step towards your production environment.
Offboard tenants the way you offboard people
Most organisations have a leaver process for staff. Accounts are disabled, access is removed and equipment is returned. Tenants need the same lifecycle: an owner while they're in use, and a proper exit when they're not.
1. Find them
Build an inventory of every tenant your organisation has created or inherited. Start with billing records and Microsoft partner relationships, ask your Microsoft account team, and check for domains you own that are verified in tenants you don't recognise. Ask the people who run trials and projects. You'll almost certainly find more than you expected.
2. Give each one an owner
Every tenant needs a named business owner and a named technical owner. If nobody will put their name to it, that tells you its future.
3. Bring the ones you keep up to standard
A tenant you keep should meet the same baseline as production: phishing-resistant MFA for administrators, a small number of Global Administrators managed through Privileged Identity Management, restricted app consent, and audit and sign-in logs sent to your SIEM. A tenant that isn't monitored is a tenant you've decided not to defend.
4. Close the ones you don't
Retiring a tenant takes more than letting the subscription lapse. Remove or transfer the custom domains so they can't be claimed with your name attached. Remove guest and cross-tenant trust with your other tenants. Delete app registrations and their secrets. Remove admin accounts, cancel the subscriptions and follow Microsoft's process for deleting the tenant itself. Then record that it's gone, so the next inventory doesn't find it again as a mystery.
5. Make it part of how projects end
The fix that lasts is a process change. Project closure, acquisition integration and trial expiry should all include the question "Did this create a tenant, and what happens to it now?" It costs nothing to ask, and asking means nobody can sell it later.
The wider point
The industry spends a lot of energy on the attack surface it can see: internet-facing servers, endpoints and the main tenant. Storm-3119 went after the parts organisations had forgotten. Its operators didn't need a zero-day. They needed tenants that their owners had stopped thinking about, and enough of them to run as a business.
Your security is only as good as your inventory. If you don't know a tenant exists, you can't defend it, and someone else may already own it.
If you'd like help finding and securing the Microsoft tenants your organisation has accumulated, talk to our team.