Loading story…
Microsoft fixed a privilege escalation flaw in Entra ID that allowed users with the built-in Agent ID Administrator role to take over arbitrary service principals, including identities unrelated to AI agents. Silverfort reported that the role could assign ownership over a target service principal, add new credentials, and then authenticate as that principal, effectively enabling full service principal takeover. The weakness stemmed from a scoping gap in Microsoft’s Agent Identity Platform, where a role intended to manage agent-related objects could also affect standard directory components.
The exposure was especially serious in tenants with highly privileged service principals, where attackers could inherit sensitive API access, integrations, or directory-level roles and potentially reach Global Administrator-equivalent power. Silverfort said the abuse path was broadly relevant because most customer tenants it analyzed had at least one privileged service principal, while ownership changes could blend in with normal administrative activity and evade detection. Microsoft addressed the issue with a backend fix that restricted the Agent ID Administrator role to agent-related objects and said the remediation was fully rolled out by April 9.
Mallory correlates global threat intelligence with your attack surface — know if you’re exposed before adversaries strike.
3 events from the most recent confirmed update back to the earliest known activity.
Security news outlets reported that Microsoft had patched the Entra ID flaw and emphasized the risk that compromised accounts or insiders with the Agent ID Administrator role could gain highly privileged access. Coverage also noted the issue was difficult to detect because ownership changes could resemble normal administrative activity.
Silverfort published research describing how users with only the Agent ID Administrator role could assign ownership of arbitrary service principals, add credentials, and authenticate as them. The disclosure warned this could enable compromise of privileged service principals and broader tenant-wide privilege escalation.
Microsoft remediated a scoping flaw in the Entra ID Agent ID Administrator role that allowed takeover of arbitrary service principals, including non-agent identities. The company restricted the role so it can affect only agent-related objects, and the fix was fully rolled out by April 9, 2026.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
3 references tracked. Mallory keeps watching after this page renders.
scworld.com
Open sourcesecurityaffairs.com
Open sourcesilverfort.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
New research warns that Microsoft Entra Agent ID can significantly widen the impact of a single credential compromise because authentication is anchored to an **agent blueprint** while privileges can be distributed across many child agent identities. Security researchers found that one blueprint principal can authenticate up to 250 agent identities per tenant, optionally span multiple tenants, and inherit a mix of service principal permissions, user-like capabilities, Entra role assignments, and delegated permissions. Datadog and Compass Security both reported that this design creates a larger blast radius than traditional Entra applications, especially when third-party or multitenant blueprints are used, because the publishing tenant controls the credential material trusted by consuming tenants. Researchers also demonstrated practical abuse paths. Compass Security showed that attackers who gain blueprint ownership or credential-management access could add credentials, create child agent identities through the `AgentIdentity.CreateAsManager` role claim, and potentially escalate privileges up to **Global Administrator**; it also described consent-phishing with a foreign multitenant blueprint to inherit permissions such as `Application.ReadUpdate.All`. Separately, Red Canary documented a suspicious non-interactive Microsoft Graph sign-in tied to an assistive agent, where the application `Agent001` authenticated with a federated identity credential, satisfied MFA via token claims rather than user interaction, and requested broad scopes including `Group.Read.All`, `Mail.ReadWrite`, `Mail.Send`, `MailboxSettings.ReadWrite`, and `User.Read`, underscoring how Agent ID workflows can blur the line between application and user access.
Jul 1, 2026Security researcher Dirk-Jan Mollema disclosed CVE-2025-55241, a flaw in Microsoft Entra ID (Azure AD) that allowed a single token to grant administrative access to every tenant worldwide. The vulnerability stemmed from improper validation of 'Actor tokens,' enabling attackers to bypass all security controls and remain undetected. This incident highlights the systemic risk of centralized authority in identity platforms and calls for distributed, authorityless security architectures.
Jun 29, 2026A severe vulnerability in Microsoft's Entra ID (formerly Azure AD) allowed attackers to use Actor Tokens from their own tenant to gain global admin privileges in any other tenant. The flaw, tracked as CVE-2025-55241, was found in the legacy Azure AD Graph API, which failed to properly validate the originating tenant. Microsoft rapidly deployed a global fix after responsible disclosure and found no evidence of exploitation.
Jun 29, 2026