Microsoft called fixing this "a reasonable ask" in 2024.
It's 2026. Still in the backlog.
Meanwhile, any namespace dev can become Azure Subscription Owner in 60 seconds. 4 kubectl applies. CVSS 9.9.
MSRC's verdict? "By design."
Three years of knowing. Zero fixes. Full writeup: https://olearysec.com/research/azure-service-operator-subscription-takeover/
#security #azure #kubernetes