If you do the basics right — update regularly, control permissions and protect logins — you’ll already be ahead of most sites on the web.

The authentication implementation flaw essentially allows a bad actor to change the mail attribute in the Entra ID account to that of a victim's and take advantage of the app's "Log in with Microsoft ...