Proofpoint Uncovers BluePhishing Attack Targeting Microsoft Entra Agent Identities
Do Son 
BluePhishing attack diagram | Image: Proofpoint
TL;DR
Security researchers introduced a new cloud intrusion technique called the BluePhishing attack. This attack adapts classic OAuth consent abuse to artificial intelligence ecosystems. By tricking a user into approving a malicious third-party blueprint, the BluePhishing attack Entra Agent ID method allows intruders to create up to 250 local agent identities inside a target network. Although no real-world campaigns have used this vector yet, default Microsoft 365 configuration changes in November 2026 significantly expand enterprise exposure.
What Happened in the Research
As enterprises integrate autonomous helpers into their cloud workflows, Microsoft Entra Agent ID extends traditional application frameworks to manage artificial intelligence identities. According to a report on BluePhishing initial access via third-party agent blueprint consent by Proofpoint researchers, this new architecture inherits many of the same security risks found in standard OAuth applications. In this model, an agent blueprint acts like an app registration. Meanwhile, a blueprint principal functions like a service principal inside a tenant.
“Proofpoint researchers present ‘BluePhishing’ as the next evolution of OAuth consent abuse, enabling attackers to leverage agent identities for initial access,” the report stated. Notably, Microsoft 365 Message Center announcement MC1506733 confirms that standard Entra users can create agent blueprints by default starting in November 2026. Consequently, Proofpoint developed a proof-of-concept attack and notified Microsoft prior to publication. This allows defenders to prepare before threat actors adopt the technique.
How the Blueprint Consent Chain Works
To launch a BluePhishing attack, an adversary first creates an agent blueprint inside their own Entra tenant and generates a client secret. Next, the attacker uses PowerShell or Microsoft Graph to set the signInAudience property to AzureADMultipleOrgs. This is a setting that cannot be modified directly inside the Entra web portal. The adversary also configures requiredResourceAccess (RRA) and inheritable permissions. This ensures that any spawned agents automatically receive broad access rights, such as User.Read.All and Group.Read.All.
Once the setup is complete, the attacker sends a crafted consent link to a target user or administrator. When the victim approves the prompt, Entra creates a blueprint principal inside the victim’s organization. “The blueprint principal is automatically assigned the AgentIdentity.CreateAsManager application permission. This permission cannot be revoked from the principal and allows the attacker to obtain an app-only Graph token in the victim tenant to create tenant-local agent identities,” Proofpoint explained.
Spawning Agents with Public Identifiers
To provision a local agent identity, the attacker only needs two pieces of information from the victim’s organization: the Tenant ID and a valid user Object ID to act as an accountable “sponsor.” Both identifiers can be discovered through unauthenticated OpenID Connect and GetCredentialType endpoints. Therefore, obtaining them requires little effort. Even worse, once the attacker creates the agent identity via Microsoft Graph, they can remove the sponsor from the object. They keep their newly minted access tokens.
Using the client secret stored in their home tenant, the attacker runs an autonomous exchange flow to acquire Microsoft Graph tokens for the local agent identity. In laboratory tests, researchers imported the resulting token into the post-exploitation tool GraphRunner to dump directory users and groups.
Who Is Behind the Activity
Proofpoint developed the BluePhishing attack Entra Agent ID methodology internally as proactive threat research. “This blog presents a research-based proof of concept. Proofpoint has not as of yet identified any in-the-wild activity, and emerging techniques should be carefully tracked as technology advances and policies surrounding new identity frameworks evolve,” the authors noted. However, because Russian, Chinese, and financially motivated threat groups already rely heavily on traditional OAuth consent phishing, security teams expect adversaries to test agent blueprints soon.
Impact and Visibility Gaps
Compared to traditional application phishing, the BluePhishing attack creates a much wider blast radius. While a standard OAuth app registration maps to a single service principal per tenant, one malicious agent blueprint can generate up to 250 distinct agent identities. Furthermore, autonomous background traffic is expected from AI agents. This allows malicious Graph queries to blend in with normal workplace automation.
Defenders also face a major auditing blind spot when reviewing delegated permissions granted through user consent links. “According to Microsoft documentation, inherited permissions are not visible in the Entra portal or via Microsoft Graph, and only observable in the token contents at runtime,” Proofpoint warned. Because administrators cannot easily see these inherited scopes in the dashboard, rogue agents can operate with hidden privileges.
How Organizations Can Stay Protected
Fortunately, existing enterprise application controls also govern agent blueprints and their derived identities. To block the BluePhishing attack Entra Agent ID vector, administrators should restrict user consent settings in the Microsoft Entra admin center so that only verified publishers or low-impact permissions are allowed. Better yet, organizations can disable user consent entirely and require administrator review for all third-party applications and agent blueprints.
In addition, security teams should enforce Conditional Access policies and Entra ID Protection rules specifically tailored for agent identities. When hunting for suspicious activity in Entra audit logs, defenders should monitor “Add application” events for new blueprint creations. They should also monitor “Add service principal” logs for newly spawned agent identities. Finally, because a malicious blueprint ID remains identical across every victim tenant it infects, incident responders can use known blueprint IDs as reliable indicators of compromise. Therefore, they can revoke access across their environments.
Support Our Threat Intelligence
Find our vulnerability reports and weekly recaps helpful? Support our work today and unlock a 100% ad-free reading experience!
Buy Me a Coffee
