TheCynosure
Joined 10 days ago
Karma
5
Submissions
3
Member since
Oct 22
Recent submissions
Comment · 5 days ago
Comment · 10 days ago
Can someone help me understand this part:
> The billing engine that trusts unverified X-ACCOUNT-USER-ID headers. The account service where admin is a tenant ID and impersonation bypasses org checks with owner role.
What is the issue with the billing engine trusting an “unverified” header here? Is the assumption that it’s not auth-ing the request? Is the billing engine internal? What does “unverified” even mean in this context.
What’s the problem with Admin being a tenant ID? How would impersonation even cause bypassing an org check?
https://www.cnbc.com/2026/10/26/microsoft-msft-voluntary-buy...