Microsoft Partner Center CVE-2024-49035: Exploited EoP
There is nothing to patch: Microsoft fixed this in its own service in November 2024, so only Microsoft partners, and customers who give partners admin rights, have a reason for a one-time access review.
Must act: Microsoft partner organizations that sign in to Partner Center, especially Cloud Solution Provider resellers and managed service providers that hold admin roles in customer tenants.
Can relax: Everyone who never uses Partner Center; there is no software, build or setting to change on your side.
- Check whether anyone in your organization signs in to Partner Center; if nobody does, close the item.
- Partners: review Partner Center users and roles, remove stale or unknown accounts, and require MFA for every partner user.
- Partners: export the Partner Center activity log and keep copies, because older entries are deleted automatically.