In April 2026, Microsoft patched a critical scope overreach vulnerability in the Entra Agent Identity Platform. The flaw centered on the newly introduced Agent ID Administrator role, which inadvertently allowed accounts to hijack arbitrary service principals and escalate privileges across an entire tenant.
What Went Wrong
The Agent Identity Platform was designed to give AI agents their own identities, managed through blueprints and agent users. To support this, Microsoft introduced the Agent ID Administrator role, intended to manage only agent-related objects.
However, because agent identities are built on top of standard application and service principal primitives, a scoping gap emerged:
- Updating agent identity owners allowed administrators to reassign ownership of any service principal in the tenant.
- Once ownership was hijacked, attackers could generate new credentials and authenticate as that application.
- If the compromised service principal had elevated directory roles or Graph API permissions, this became a direct path to full tenant compromise.
Attack Flow
- Assign Ownership: Attacker with Agent ID Administrator privileges reassigns ownership of a privileged service principal.
- Generate Credentials: New keys or secrets are created under attacker control.
- Authenticate as Application: Attacker impersonates the service principal.
- Privilege Escalation: Elevated roles or Graph API permissions grant broad access across the tenant.
Why This Matters
Service principals are often overlooked compared to user accounts, yet they frequently hold admin-level directory roles or high-impact API permissions. This makes them prime targets for attackers.
Silverfort researchers highlighted that this vulnerability demonstrates how non-human identities can be abused if privilege boundaries aren’t strictly enforced.
Defensive Guidance
- Patch Immediately: Microsoft has fixed the issue across all cloud environments as of April 2026.
- Audit Service Principals: Use Azure CLI and Graph API queries to identify privileged service principals.
- Monitor Logs: Watch for suspicious events involving ownership changes or credential additions.
- Treat Service Principals as Critical Infrastructure: Apply the same rigor as with admin accounts.
- Implement Least Privilege: Ensure roles are scoped narrowly and reviewed regularly.
Final Thought
The Entra Agent ID Administrator flaw is a reminder that identity boundaries must be airtight. Even roles designed for specialized use can inadvertently expose pathways to full compromise if they overlap with core primitives like service principals. For defenders, the lesson is clear: non-human identities are just as critical as human ones — and must be monitored, audited, and protected with equal vigilance.
Leave a Reply