Proofpoint details BluePhishing attack on Microsoft Entra agent identities
Original title: BluePhishing Attack Abuses Microsoft Entra OAuth Consent to Create Hidden AI Agent Identities
One admin consent can create persistent agent identities; Proofpoint reports no observed real-world use.
Proofpoint describes BluePhishing, a research proof of concept that extends OAuth consent phishing to Microsoft Entra Agent ID. An attacker-controlled blueprint, after one consent click, can receive AgentIdentity.CreateAsManager and mint agent identities in the victim tenant. Admin consent can grant tenant-wide application permissions; user consent is limited to delegated permissions. Proofpoint says it has not identified in-the-wild activity.
Unconfirmed: Proofpoint presents this as research only and has not identified in-the-wild activity.
- Microsoft documents a limit of 250 agent identities per non-Microsoft blueprint.
- Proofpoint says AgentIdentity.CreateAsManager cannot be revoked from the principal.
- Message Center post MC1506733 says default users can create blueprints from November 2026.
- Inherited permissions are visible only in runtime tokens, not the Entra portal.
- The same blueprint ID appears in every tenant that consents to it.
Impact: Persistent agent identities with broad Graph application permissions
| Product | Affected |
|---|---|
| Microsoft Entra Agent ID | — |
- 1.Train users on consenting to third-party agents and restrict approvals with permission classifications.
- 2.Hunt and remove known malicious blueprints using the shared blueprint ID.
- 3.Monitor audit logs for Add application and Add service principal events.
- Vendors
- Microsoft
- Products
- Microsoft EntraMicrosoft Graph
- Malware
- GraphRunner
- Organizations
- Proofpoint
From the original article
3 min read at gbhackers.com
“BluePhishing,” a technique that extends OAuth consent phishing to Microsoft Entra’s AI agent model. The attacker needs only one consent click to create persistent agent identities inside a victim tenant. Proofpoint says this is a research-based proof of concept and it has not identified any in-the-wild activity Microsoft Entra Agent ID extends Entra to AI […]
By Mayura Kathir · gbhackers.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.