Azure's Hidden Operators: A Threat Model for Platform-Level Managed Identities

Researcher Kat Traxler identifies Platform-Level Managed Identities (PLMIs)—hidden Azure identities created and controlled by Microsoft to operate platform services—as a security threat due to their global, cross-tenant access. Drawing on Binary Security’s March 2025 research showing how attackers exploited API Connections to access Key Vaults and other backend resources, the article argues that Azure lacks customer-side preventive controls to mitigate confused deputy attacks, unlike AWS and Google Cloud alternatives.