Tutorial on how to deny Guest users in Azure AD[1] In general, one should always use roles in Azure. Even if you have a flaw like this, your endpoint would be

Tutorial on how to deny Guest users in Azure AD[1] In general, one should always use roles in Azure. Even if you have a flaw like this, your endpoint would be safe if you required a role to access your endpoint. For multi-tenants, I completely this misconfiguration, there’s no real warnings when configuring it. In order to lock down to specific tenants, I recommend having a list of issuers that you check the token against.[2] [1] https://intility.github.io/fastapi-azure-auth/single-tenant/guest_users https://intility.github.io/fastapi-azure-auth/single-tenant/... [2] https://intility.github.io/fastapi-azure-auth/multi-tenant/accept_specific_tenants_only https://intility.github.io/fastapi-azure-auth/multi-tenant/a...