# BluePhishing: Initial Access via Third-Party Agent Blueprint Consent (Microsoft Entra Agent ID)

> Proofpoint published a research proof of concept (2026-11-09) in which an attacker socially engineers a victim into consenting to a malicious Microsoft Entra agent blueprint. Consent creates a blueprint principal in the victim tenant, and the attacker then uses the blueprint's client credentials to create agent identities and obtain Graph tokens with the privileges assigned to them. Proofpoint reports no in-the-wild activity.

- **Published:** 2026-11-10T00:36:24Z
- **Last reviewed:** 2026-11-10T00:36:24Z
- **Canonical:** https://intel.threadlinqs.com/threat/TL-2026-5607
- **Card image:** https://intel.threadlinqs.com/og/threat/TL-2026-5607.png
- **ID:** TL-2026-5607
- **Severity:** MEDIUM
- **Category:** PHISHING
- **Status:** TRACKING
- **Detections:** 9 (1 shown free below) · **IOCs:** 11 (2 shown free below)

## Description

BluePhishing is an OAuth consent-phishing variant that abuses Microsoft Entra Agent ID. Entra Agent ID extends Entra to AI agents and mirrors the app model: a blueprint is like an app registration, a blueprint principal is like a service principal, and an agent identity is an instance created from a blueprint. The attacker creates an agent blueprint in their own tenant and sets its signInAudience to AzureADMultipleOrgs so that external tenants can consent to it. That value is not exposed in the Entra portal and must be set through Microsoft Graph, PowerShell or the app manifest. The attacker adds a client secret, application and delegated permissions, requiredResourceAccess (RRA) entries and inheritable permissions. Inherited permissions are not visible in the portal or via Graph, only in the contents of runtime tokens.

The victim is lured to an admin consent link of the form https://login.microsoftonline.com/{tenant}/v2.0/adminconsent?client_id={blueprint_id}&scope=https://graph.microsoft.com/.default&redirect_uri={redirect_uri}. The .default scope grants everything pre-configured in RRA. Consent links need response_type=none because interactive token acquisition is blocked for blueprints. Application permissions require admin consent (broader reach, admin victim needed); user consent grants delegated permissions and, if user consent policy blocks the user, the request can be forwarded for admin approval. Delegated permissions cannot use the autonomous flow. Consent creates a blueprint principal in the victim tenant that implicitly receives the AgentIdentity.CreateAsManager application permission, which Proofpoint states (citing Microsoft documentation) cannot be revoked from the principal.

The attacker then requests a client-credentials token from the victim tenant's /oauth2/v2.0/token endpoint using the blueprint application ID and secret, scope https://graph.microsoft.com/.default. The token carries the AgentIdentity.CreateAsManager role (idtyp app, appidacr 1). With it the attacker calls POST https://graph.microsoft.com/v1.0/servicePrincipals/Microsoft.Graph.AgentIdentity with displayName, agentIdentityBlueprintId and a sponsors@odata.bind value pointing to a victim user's object ID. The sponsor is a governance requirement and can be removed after provisioning. One blueprint can create up to 250 agent identities. The attacker obtains agent tokens through the autonomous agent app flow: the blueprint credentials plus an fmi_path value set to the agent identity's client ID yield an exchange token, which is then swapped for a Microsoft Graph access token.

In the PoC the agent identity held User.Read.All and Group.Read.All and GraphRunner was used to run arbitrary Graph requests for enumeration. Prerequisites are the blueprint application ID and secret, the victim tenant ID (from the tenant's OpenID configuration endpoint) and a victim sponsor user object ID (users can be enumerated via the GetCredentialType endpoint, credited to RedFoxSec). Proofpoint observed silent inheritance of permissions to agent identities only for delegated permissions granted via user consent; admin-consent grants showed the source as 'inherited from parent'. Microsoft already blocks high-risk Graph permissions such as User.ReadWrite.All for agents. Proofpoint cites larger blast radius (up to 250 identities per blueprint), weaker consent governance than for apps, invisible inherited scopes, and autonomous agent activity that blends into legitimate use as impact factors.

Independent June 2026 research corroborates the underlying design risk. Compass Security (published 2026-06-09) describes an 'Agent ID consent phishing' path in which a multitenant blueprint with inheritable Graph permissions is consented to by a victim-tenant admin, the attacker authenticates as the blueprint principal, creates an agent identity that inherits Application.ReadUpdate.All, and adds a credential to an existing app registration. Compass also reports that AgentIdentity.CreateAsManager appeared in every blueprint principal token and that many permissions blocked by name have assignable equivalents. Datadog Security Labs (2026-06-11) shows that holding a blueprint secret allows a two-step client_credentials exchange (scope api://AzureADTokenExchange/.default with fmi_path) to act as any linked agent identity, including across tenants.

The blueprint application ID is consistent across consenting tenants, so it is a cross-tenant indicator defenders can use to detect or remove known malicious blueprints. Proofpoint published no blueprint IDs, domains, IPs or hashes. Microsoft Message Center MC1506733 (announced 2026-10-13 per third-party coverage) says default users will be able to create agent blueprints from November 2026, which widens exposure. Proofpoint notified Microsoft before publication. This is a forward-looking, proof-of-concept threat with no confirmed exploitation, no named actor and no CVE.

## MITRE ATT&CK

- T1566.002 Spearphishing Link
- T1204.001 Malicious Link
- T1078.004 Cloud Accounts
- T1528 Steal Application Access Token
- T1550.001 Application Access Token
- T1136.003 Cloud Account
- T1671 Cloud Application Integration
- T1098.001 Additional Cloud Credentials
- T1087.004 Cloud Account
- T1069.003 Cloud Groups
- T1589.002 Email Addresses

## Free detection (Splunk SPL, Microsoft KQL, Sigma)

**BluePhishing: Consent or Blueprint Principal Creation Granting AgentIdentity.CreateAsManager (TL-2026-5607)** (`TL-2026-5607-SPL-001`)

Detects Entra audit events (consent, service principal creation, app role or delegated grant) that reference an agent identity blueprint or the AgentIdentity.CreateAsManager role. In the BluePhishing proof of concept, consent to a third-party blueprint creates a blueprint principal in the victim tenant that implicitly holds AgentIdentity.CreateAsManager, which lets the attacker mint agent identities. Any such event for a blueprint you did not onboard is the exploitation moment. Maps to T1566.002, T1204.001 and T1078.004.

- **Languages:** Splunk SPL, Microsoft KQL, Sigma
- **ATT&CK:** T1566.002, T1204.001, T1078.004
- **Data sources:** azure_ad_audit_logs (index=azure sourcetype=azure:monitor:aad category=AuditLogs), AuditLogs (Microsoft Sentinel), azure auditlogs
- **Severity:** high
- **Confidence:** high

### Splunk SPL

```spl
index=azure sourcetype="azure:monitor:aad" category="AuditLogs" properties.result=success earliest=-24h
(operationName="Consent to application" OR operationName="Add service principal" OR operationName="Add app role assignment to service principal" OR operationName="Add delegated permission grant")
("AgentIdentity.CreateAsManager" OR "AgentIdentityBlueprint" OR "agent identity blueprint")
| eval actor=coalesce('properties.initiatedBy.user.userPrincipalName','properties.initiatedBy.app.displayName'), src_ip=coalesce('properties.initiatedBy.user.ipAddress','properties.initiatedBy.app.ipAddress'), target=mvjoin('properties.targetResources{}.displayName',";")
| stats count earliest(_time) as first_seen latest(_time) as last_seen values(operationName) as operations values(target) as targets values(src_ip) as src_ips by actor
| convert ctime(first_seen) ctime(last_seen)
| table first_seen last_seen actor operations targets src_ips count
```

### Microsoft KQL

```kql
AuditLogs
| where TimeGenerated > ago(24h)
| where OperationName in ("Consent to application", "Add service principal", "Add app role assignment to service principal", "Add delegated permission grant")
| where Result =~ "success"
| extend TargetJson = tostring(TargetResources)
| where TargetJson has_any ("AgentIdentity.CreateAsManager", "AgentIdentityBlueprint", "agent identity blueprint")
| extend Actor = coalesce(tostring(InitiatedBy.user.userPrincipalName), tostring(InitiatedBy.app.displayName)), SourceIp = coalesce(tostring(InitiatedBy.user.ipAddress), tostring(InitiatedBy.app.ipAddress)), TargetName = tostring(TargetResources[0].displayName)
| project TimeGenerated, OperationName, Actor, SourceIp, TargetName, CorrelationId
```

### Sigma

```yaml
title: BluePhishing Blueprint Principal Consent With AgentIdentity.CreateAsManager
id: 3f7a1c52-9b4e-4d68-a1f3-7c2e5b8d9a11
status: experimental
description: Detects Entra audit events for consent, service principal creation or role assignment that reference agent identity blueprints or the AgentIdentity.CreateAsManager role.
references:
  - https://www.proofpoint.com/us/blog/threat-insight/BluePhishing-Initial-Access-via-Third-Party-Agent-Blueprint-Consent
author: Threadlinqs Team
date: 2026-11-10
tags:
  - attack.initial-access
  - attack.t1566.002
  - attack.execution
  - attack.t1204.001
  - attack.t1078.004
logsource:
  product: azure
  service: auditlogs
detection:
  selection_op:
    properties.message:
      - 'Consent to application'
      - 'Add service principal'
      - 'Add app role assignment to service principal'
      - 'Add delegated permission grant'
  selection_agent:
    - 'AgentIdentity.CreateAsManager'
    - 'AgentIdentityBlueprint'
  condition: selection_op and selection_agent
falsepositives:
  - Sanctioned onboarding of a first-party or vendor agent blueprint by an Agent ID Administrator
level: high
```

**Known false positives:**

- Planned onboarding of a legitimate vendor or internal agent blueprint by an Agent ID Administrator
- Microsoft first-party agent platform provisioning that references blueprint objects

**Tuning notes:** Maintain a lookup of approved blueprint application IDs and exclude them. Confirm the exact operationName strings in your tenant's AuditLogs, since Agent ID operation names may change as the feature matures. Escalate when the consenting actor is not an Agent ID Administrator or Global Administrator.

### 8 more detection rules (Splunk SPL, Microsoft KQL, Sigma), unlock with TL Creds

- BluePhishing: Consent Granting High-Impact Graph Permissions to a Third-Party Blueprint or App (locked: unlock with TL Creds)
- BluePhishing: Agent Identity Sponsor Changed or Removed After Creation (locked: unlock with TL Creds)
- BluePhishing: App-Only Microsoft Graph User and Group Enumeration Burst (locked: unlock with TL Creds)
- BluePhishing: Admin Consent Phishing URL With response_type=none Targeting Graph .default (locked: unlock with TL Creds)
- BluePhishing: Credential Added to Application or Service Principal by an App Principal (locked: unlock with TL Creds)
- BluePhishing: GraphRunner Post-Access Enumeration Tooling on Endpoints (locked: unlock with TL Creds)
- BluePhishing: Agent Identity Created by an Application (Blueprint Principal) Context (locked: unlock with TL Creds)
- BluePhishing: Blueprint-to-Agent Token Exchange From a New Source IP (fmi_path flow) (locked: unlock with TL Creds)

Sign up free to unlock the detection rules: https://threadlinqs.com/?modal=signup

## Sample indicators (2 of 11)

Defanged, TLP:CLEAR.

- Domain: `login[.]microsoftonline[.]com`
- Domain: `graph[.]microsoft[.]com`

Full set of 11 indicators unlocks with TL Creds: https://threadlinqs.com/tl-creds

## Sources

- [BluePhishing: Initial Access via Third-Party Agent Blueprint Consent (Proofpoint, Rachel Rabin)](https://www.proofpoint.com/us/blog/threat-insight/BluePhishing-Initial-Access-via-Third-Party-Agent-Blueprint-Consent)
- [Compass Security: Entra Agent ID from a security perspective](https://blog.compass-security.com/2026/06/entra-agent-id-from-a-security-perspective/)
- [Datadog Security Labs: Entra Agent ID, the blueprint blast radius](https://securitylabs.datadoghq.com/articles/agent-id-blueprint-blast-radius)
- [Microsoft Learn: Agent blueprint](https://learn.microsoft.com/en-us/entra/agent-id/agent-blueprint)
- [Microsoft Learn: Inheritable permissions concept](https://learn.microsoft.com/en-us/entra/agent-id/concept-inheritable-permissions)
- [Microsoft Learn: Configure inheritable permissions on blueprints](https://learn.microsoft.com/en-au/Entra/agent-id/configure-inheritable-permissions-blueprints)
- [Microsoft Learn: Agent creation channels (AgentIdentity.CreateAsManager)](https://learn.microsoft.com/en-us/entra/agent-id/agent-id-creation-channels)
- [Microsoft Learn: Autonomous agent app OAuth flow](https://learn.microsoft.com/en-us/entra/agent-id/agent-autonomous-app-oauth-flow)
- [Microsoft Learn: Sign-in and audit logs for agents](https://learn.microsoft.com/en-us/entra/agent-id/sign-in-audit-logs-agents)
- [Microsoft Learn: Conditional Access policies for autonomous agents](https://learn.microsoft.com/en-us/entra/identity/conditional-access/policy-autonomous-agents)
- [Microsoft Learn: Entra ID Protection risky agents](https://learn.microsoft.com/en-us/entra/id-protection/concept-risky-agents)
- [Microsoft Learn: Configure user consent](https://learn.microsoft.com/en-us/entra/identity/enterprise-apps/configure-user-consent)
- [AdminDroid: Microsoft Entra allows default users to create agent identity blueprints (MC1506733)](https://blog.admindroid.com/microsoft-entra-allows-default-users-to-create-agent-identity-blueprints/)
- [Office365ITPros: Agent blueprint option](https://office365itpros.com/2026/10/15/agent-blueprint-option/amp/)
- [Jan Bakker: Prevent users from creating new agent identity blueprints](https://janbakker.tech/prevent-users-from-creating-new-agent-identity-blueprints/)

## Full data

The other 8 detection rules (Splunk SPL / Microsoft KQL / Sigma) unlock with TL Creds; a free account includes daily creds: https://threadlinqs.com/?modal=signup
Indicator values unlock with TL Creds, at a lower price on Red and Purple; AI agents can query rules and IOCs through the Threadlinqs MCP server (Purple): https://intel.threadlinqs.com/mcp

Canonical: https://intel.threadlinqs.com/threat/TL-2026-5607