The default ADFS installation permits access to "HTTP traffic from any system" and any local administrator account on the ADFS server can then be leveraged for access.

Security solutions firm FireEye on Tuesday described how Active Directory Federation Services (ADFS) could have been exploited to gain access to Microsoft 365 e-mails during the Nobelium ...