Threat reportPhishingTL-2026-5607
BluePhishing: Initial Access via Third-Party Agent Blueprint Consent (Microsoft Entra Agent ID)
Proofpoint published a research proof of concept (2026-11-09) in which an attacker socially engineers a victim into consenting to a malicious Microsoft Entra agent blueprint. Consent creates a blueprint principal in the victim tenant, and the attacker then uses the blueprint's client credentials to create agent identities and obtain Graph tokens with the privileges assigned to them.
Key facts
| Identifiers | TL-2026-5607 |
|---|---|
| Also known as | BluePhishing |
| Severity | MEDIUM |
| First disclosed | |
| Affected products | Microsoft Microsoft Entra ID (Agent ID, agent identity blueprints) |
| Tools | EntraFalcon, GraphRunner, agent-permission-checker |
| MITRE ATT&CK techniques | T1069.003 Cloud Groups, T1078.004 Cloud Accounts, T1087.004 Cloud Account, T1098.001 Additional Cloud Credentials, T1136.003 Cloud Account, T1204.001 Malicious Link, T1528 Steal Application Access Token, T1550.001 Application Access Token, T1566.002 Spearphishing Link, T1589.002 Email Addresses, T1671 Cloud Application Integration |
| Motivation | UNKNOWN |
| Target sectors | technology, government administration, finance, health, education |
| Target regions | Global |
| Detection rules | 9 (1 shown free) |
| Sources | 16 cited sources |
Detection coverage
As of 2026-11-10, Threadlinqs Intelligence publishes 9 detection rule(s) for TL-2026-5607 across Splunk SPL, Microsoft KQL and Sigma, covering 11 indicator(s) of compromise. The whole corpus is readable without an account. Every threat comes with one complete detection in Splunk SPL, Microsoft KQL and Sigma, free for everyone; a free account adds daily TL Creds to unlock the rest. Paid plans add a larger daily allowance, correlation and the MCP server. Threadlinqs MCP server · View plans.
Free detection: BluePhishing: Consent or Blueprint Principal Creation Granting AgentIdentity.CreateAsManager (TL-2026-5607)
Detects Entra audit events (consent, service principal creation, app role or delegated grant) that reference an agent identity blueprint or the AgentIdentity.CreateAsManager role. In the BluePhishing proof of concept, consent to a third-party blueprint creates a blueprint principal in the victim tenant that implicitly holds AgentIdentity.CreateAsManager, which lets the attacker mint agent identities. Any such event for a blueprint you did not onboard is the exploitation moment. Maps to T1566.002, T1204.001 and T1078.004.
- Languages: Splunk SPL, Microsoft KQL, Sigma
- ATT&CK: T1566.002, T1204.001, T1078.004
- Data sources: azure_ad_audit_logs (index=azure sourcetype=azure:monitor:aad category=AuditLogs), AuditLogs (Microsoft Sentinel), azure auditlogs
- Severity: high
- Confidence: high
Splunk SPL
index=azure sourcetype="azure:monitor:aad" category="AuditLogs" properties.result=success earliest=-24h
(operationName="Consent to application" OR operationName="Add service principal" OR operationName="Add app role assignment to service principal" OR operationName="Add delegated permission grant")
("AgentIdentity.CreateAsManager" OR "AgentIdentityBlueprint" OR "agent identity blueprint")
| eval actor=coalesce('properties.initiatedBy.user.userPrincipalName','properties.initiatedBy.app.displayName'), src_ip=coalesce('properties.initiatedBy.user.ipAddress','properties.initiatedBy.app.ipAddress'), target=mvjoin('properties.targetResources{}.displayName',";")
| stats count earliest(_time) as first_seen latest(_time) as last_seen values(operationName) as operations values(target) as targets values(src_ip) as src_ips by actor
| convert ctime(first_seen) ctime(last_seen)
| table first_seen last_seen actor operations targets src_ips countMicrosoft KQL
AuditLogs
| where TimeGenerated > ago(24h)
| where OperationName in ("Consent to application", "Add service principal", "Add app role assignment to service principal", "Add delegated permission grant")
| where Result =~ "success"
| extend TargetJson = tostring(TargetResources)
| where TargetJson has_any ("AgentIdentity.CreateAsManager", "AgentIdentityBlueprint", "agent identity blueprint")
| extend Actor = coalesce(tostring(InitiatedBy.user.userPrincipalName), tostring(InitiatedBy.app.displayName)), SourceIp = coalesce(tostring(InitiatedBy.user.ipAddress), tostring(InitiatedBy.app.ipAddress)), TargetName = tostring(TargetResources[0].displayName)
| project TimeGenerated, OperationName, Actor, SourceIp, TargetName, CorrelationIdSigma
title: BluePhishing Blueprint Principal Consent With AgentIdentity.CreateAsManager
id: 3f7a1c52-9b4e-4d68-a1f3-7c2e5b8d9a11
status: experimental
description: Detects Entra audit events for consent, service principal creation or role assignment that reference agent identity blueprints or the AgentIdentity.CreateAsManager role.
references:
- https://www.proofpoint.com/us/blog/threat-insight/BluePhishing-Initial-Access-via-Third-Party-Agent-Blueprint-Consent
author: Threadlinqs Team
date: 2026-11-10
tags:
- attack.initial-access
- attack.t1566.002
- attack.execution
- attack.t1204.001
- attack.t1078.004
logsource:
product: azure
service: auditlogs
detection:
selection_op:
properties.message:
- 'Consent to application'
- 'Add service principal'
- 'Add app role assignment to service principal'
- 'Add delegated permission grant'
selection_agent:
- 'AgentIdentity.CreateAsManager'
- 'AgentIdentityBlueprint'
condition: selection_op and selection_agent
falsepositives:
- Sanctioned onboarding of a first-party or vendor agent blueprint by an Agent ID Administrator
level: highKnown false positives:
- Planned onboarding of a legitimate vendor or internal agent blueprint by an Agent ID Administrator
- Microsoft first-party agent platform provisioning that references blueprint objects
Tuning notes: Maintain a lookup of approved blueprint application IDs and exclude them. Confirm the exact operationName strings in your tenant's AuditLogs, since Agent ID operation names may change as the feature matures. Escalate when the consenting actor is not an Agent ID Administrator or Global Administrator.
- BluePhishing: Consent Granting High-Impact Graph Permissions to a Third-Party Blueprint or App · unlock with TL Creds
- BluePhishing: Agent Identity Sponsor Changed or Removed After Creation · unlock with TL Creds
- BluePhishing: App-Only Microsoft Graph User and Group Enumeration Burst · unlock with TL Creds
- BluePhishing: Admin Consent Phishing URL With response_type=none Targeting Graph .default · unlock with TL Creds
- BluePhishing: Credential Added to Application or Service Principal by an App Principal · unlock with TL Creds
- BluePhishing: GraphRunner Post-Access Enumeration Tooling on Endpoints · unlock with TL Creds
- BluePhishing: Agent Identity Created by an Application (Blueprint Principal) Context · unlock with TL Creds
- BluePhishing: Blueprint-to-Agent Token Exchange From a New Source IP (fmi_path flow) · unlock with TL Creds
Indicators of compromise
As of 2026-11-10, Threadlinqs Intelligence tracks 11 indicators of compromise for TL-2026-5607.
Sample indicators (2 of 11)
- Domain:
login[.]microsoftonline[.]com - Domain:
graph[.]microsoft[.]com
Defanged, TLP:CLEAR. Full set of 11 indicators: unlock with TL Creds.
Technical analysis
Proofpoint reports no in-the-wild activity.
BluePhishing is an OAuth consent-phishing variant that abuses Microsoft Entra Agent ID. Entra Agent ID extends Entra to AI agents and mirrors the app model: a blueprint is like an app registration, a blueprint principal is like a service principal, and an agent identity is an instance created from a blueprint. The attacker creates an agent blueprint in their own tenant and sets its signInAudience to AzureADMultipleOrgs so that external tenants can consent to it. That value is not exposed in the Entra portal and must be set through Microsoft Graph, PowerShell or the app manifest. The attacker adds a client secret, application and delegated permissions, requiredResourceAccess (RRA) entries and inheritable permissions. Inherited permissions are not visible in the portal or via Graph, only in the contents of runtime tokens.
The victim is lured to an admin consent link of the form https://login.microsoftonline.com/{tenant}/v2.0/adminconsent?client_id={blueprint_id}&scope=https://graph.microsoft.com/.default&redirect_uri={redirect_uri}. The .default scope grants everything pre-configured in RRA. Consent links need response_type=none because interactive token acquisition is blocked for blueprints. Application permissions require admin consent (broader reach, admin victim needed); user consent grants delegated permissions and, if user consent policy blocks the user, the request can be forwarded for admin approval. Delegated permissions cannot use the autonomous flow. Consent creates a blueprint principal in the victim tenant that implicitly receives the AgentIdentity.CreateAsManager application permission, which Proofpoint states (citing Microsoft documentation) cannot be revoked from the principal.
The attacker then requests a client-credentials token from the victim tenant's /oauth2/v2.0/token endpoint using the blueprint application ID and secret, scope https://graph.microsoft.com/.default. The token carries the AgentIdentity.CreateAsManager role (idtyp app, appidacr 1). With it the attacker calls POST https://graph.microsoft.com/v1.0/servicePrincipals/Microsoft.Graph.AgentIdentity with displayName, agentIdentityBlueprintId and a sponsors@odata.bind value pointing to a victim user's object ID. The sponsor is a governance requirement and can be removed after provisioning. One blueprint can create up to 250 agent identities. The attacker obtains agent tokens through the autonomous agent app flow: the blueprint credentials plus an fmi_path value set to the agent identity's client ID yield an exchange token, which is then swapped for a Microsoft Graph access token.
In the PoC the agent identity held User.Read.All and Group.Read.All and GraphRunner was used to run arbitrary Graph requests for enumeration. Prerequisites are the blueprint application ID and secret, the victim tenant ID (from the tenant's OpenID configuration endpoint) and a victim sponsor user object ID (users can be enumerated via the GetCredentialType endpoint, credited to RedFoxSec). Proofpoint observed silent inheritance of permissions to agent identities only for delegated permissions granted via user consent; admin-consent grants showed the source as 'inherited from parent'. Microsoft already blocks high-risk Graph permissions such as User.ReadWrite.All for agents. Proofpoint cites larger blast radius (up to 250 identities per blueprint), weaker consent governance than for apps, invisible inherited scopes, and autonomous agent activity that blends into legitimate use as impact factors.
Independent June 2026 research corroborates the underlying design risk. Compass Security (published 2026-06-09) describes an 'Agent ID consent phishing' path in which a multitenant blueprint with inheritable Graph permissions is consented to by a victim-tenant admin, the attacker authenticates as the blueprint principal, creates an agent identity that inherits Application.ReadUpdate.All, and adds a credential to an existing app registration. Compass also reports that AgentIdentity.CreateAsManager appeared in every blueprint principal token and that many permissions blocked by name have assignable equivalents. Datadog Security Labs (2026-06-11) shows that holding a blueprint secret allows a two-step client_credentials exchange (scope api://AzureADTokenExchange/.default with fmi_path) to act as any linked agent identity, including across tenants.
The blueprint application ID is consistent across consenting tenants, so it is a cross-tenant indicator defenders can use to detect or remove known malicious blueprints. Proofpoint published no blueprint IDs, domains, IPs or hashes. Microsoft Message Center MC1506733 (announced 2026-10-13 per third-party coverage) says default users will be able to create agent blueprints from November 2026, which widens exposure. Proofpoint notified Microsoft before publication. This is a forward-looking, proof-of-concept threat with no confirmed exploitation, no named actor and no CVE.
MITRE ATT&CK techniques by tactic:
Discovery
T1069.003 Cloud Groups; T1087.004 Cloud Account
Initial Access
T1078.004 Cloud Accounts; T1566.002 Spearphishing Link
Persistence
T1098.001 Additional Cloud Credentials; T1136.003 Cloud Account; T1671 Cloud Application Integration
Execution
Credential Access
T1528 Steal Application Access Token
lateral-movement
T1550.001 Application Access Token
Reconnaissance
Remediation
Immediate actions
- Monitor Entra audit logs for 'Create an agent identity blueprint -> Add application' and 'Create an agent identity -> Add service principal' events
- Review existing blueprint principals and agent identities in the tenant and remove any that are unrecognized
- Investigate agent identities whose sponsor is a user who did not request them
- Block or remove any known malicious blueprint application IDs, which are consistent across consenting tenants
- Alert on new consents for foreign (external-tenant) blueprints and on agent identities created by blueprint principals
Workarounds
- Set the default user role permission for creating agent blueprints to No, as described in third-party coverage of MC1506733
- Train users and admins to treat unsolicited consent links for unknown applications as suspicious
Longer-term hardening
- Restrict user consent and apply permission classifications (Enterprise applications > Consent and permissions)
- Apply least privilege to agent identities and blueprint principals; avoid high-impact permissions for foreign-controlled blueprint principals
- Apply Conditional Access for agents and Entra ID Protection for agents (risky agents)
- Review agent sign-in audit logs
- Evaluate the 'Users can create agent blueprints' default user role permission before the MC1506733 rollout reaches the tenant
- Protect holders of Agent ID Administrator, AI Administrator and AgentIdentityBlueprint.* permissions with strong MFA and Conditional Access (Compass Security guidance)
Affected and fixed versions
- Microsoft — Microsoft Entra ID (Agent ID, agent identity blueprints)
Vulnerable versions: Tenants that permit consent to third-party agent blueprints
Timeline
- Compass Security demonstrates Agent ID blueprint-owner abuse and Agent ID consent-phishing paths in a lab (demonstration timestamps around late May 2026).
- Compass Security (Christian Feuchter) publishes 'Entra Agent ID from a security perspective', describing consent phishing with multitenant blueprints and inheritable permissions.
- Datadog Security Labs publishes 'Entra Agent ID: The blueprint blast radius', describing blueprint secret abuse and the fmi_path two-step token exchange across tenants.
- Microsoft Message Center MC1506733 announced (per third-party coverage): default users will be able to create agent blueprints via a new 'Users can create agent blueprints' default user role permission.
- Office365ITPros publishes coverage of the agent blueprint creation option, flagging the admin setting under Default user role permissions.
- Per third-party coverage, rollout of default-user agent blueprint creation was to begin in early November 2026 (date approximate, month-level source).
- Proofpoint (Rachel Rabin) publishes the BluePhishing research PoC. Microsoft was notified before publication and no in-the-wild activity was identified.
- Per third-party coverage, the MC1506733 rollout was expected to finish by late November 2026 (projected, month-level source).
Sources cited
Showing 15 of 16 sources, primary sources first.
- BluePhishing: Initial Access via Third-Party Agent Blueprint Consent (Proofpoint, Rachel Rabin) Proofpoint · Research · 2026-11-09
- Compass Security: Entra Agent ID from a security perspective blog.compass-security.com · Research · 2026-06-09
- Datadog Security Labs: Entra Agent ID, the blueprint blast radius securitylabs.datadoghq.com · Research · 2026-06-11
- Microsoft Learn: Agent blueprint Microsoft · Vendor report
- Microsoft Learn: Inheritable permissions concept Microsoft · Vendor report
- Microsoft Learn: Configure inheritable permissions on blueprints Microsoft · Vendor report
- Microsoft Learn: Agent creation channels (AgentIdentity.CreateAsManager) Microsoft · Vendor report
- Microsoft Learn: Autonomous agent app OAuth flow Microsoft · Vendor report
- Microsoft Learn: Sign-in and audit logs for agents Microsoft · Vendor report
- Microsoft Learn: Conditional Access policies for autonomous agents Microsoft · Vendor report
- Microsoft Learn: Entra ID Protection risky agents Microsoft · Vendor report
- Microsoft Learn: Configure user consent Microsoft · Vendor report
- Agent Permission Checker (tool cited by Proofpoint) agent-permission-checker.pages.dev · Code repository
- AdminDroid: Microsoft Entra allows default users to create agent identity blueprints (MC1506733) blog.admindroid.com · Blog
- Office365ITPros: Agent blueprint option office365itpros.com · Blog · 2026-10-15
Further reading
Drafted by the Threadlinqs research pipeline from 16 sources; published ; last updated —.
