How I could've accessed 17 trillion Microsoft records

An unsigned JWT. In 2026. Setting {“alg”:“none”} and a upn claim of admin got a researcher full query access to Titan, a Microsoft internal analytics service that checked tenant, audience and app ID on the token but never the signature. Behind that endpoint: 17,333,335,124,315 rows across 17 databases and 9,863 tables. Bounty paid: $5,000. Worth asking what your own services verify versus what they merely parse.