For example, from the 2023 MGM assault, the attacker instantly accessed an account with Super Admin permissions in Okta, which they combined with an inbound federation attack to impersonate any consumer during the tenant, get Azure admin privileges, and authenticate on the Azure-hosted VMware environment exactly where they deployed ransomware. In