Abusing Exchange: One API call away from Domain Admin

https://t.co/jthhRNauEl