Microsoft Entra Agent ID Blueprint Model Expands Cross-Tenant Compromise Risk

New research warns that Microsoft Entra Agent ID can significantly widen the impact of a single credential compromise because authentication is anchored to an agent blueprint while privileges can be distributed across many child agent identities. Security researchers found that one blueprint principal can authenticate up to 250 agent identities per tenant, optionally span multiple tenants, and inherit a mix of service principal permissions, user-like capabilities, Entra role assignments, and delegated permissions. Datadog and Compass Security both reported that this design creates a larger blast radius than traditional Entra applications, especially when third-party or multitenant blueprints are used, because the publishing tenant controls the credential material trusted by consuming tenants.

Researchers also demonstrated practical abuse paths. Compass Security showed that attackers who gain blueprint ownership or credential-management access could add credentials, create child agent identities through the AgentIdentity.CreateAsManager role claim, and potentially escalate privileges up to Global Administrator; it also described consent-phishing with a foreign multitenant blueprint to inherit permissions such as Application.ReadUpdate.All. Separately, Red Canary documented a suspicious non-interactive Microsoft Graph sign-in tied to an assistive agent, where the application Agent001 authenticated with a federated identity credential, satisfied MFA via token claims rather than user interaction, and requested broad scopes including Group.Read.All, Mail.ReadWrite, Mail.Send, MailboxSettings.ReadWrite, and User.Read, underscoring how Agent ID workflows can blur the line between application and user access.