This is impressively bad. Literally Office365 let you simply claim to be anyone you wanted to via SAML. They didn&#x27;t bother checking the user was actually in the same domain as the SAML Identity Provider. I can&#x27;t get over how insanely incompetent that is...