MICROSOFT ENTRA ID · TECH-202611-i5au3f · Vendor
NO FIX YET · SEE WHAT TO DO
Proofpoint (9 Nov 2026) shows OAuth consent phishing extended to Microsoft Entra Agent ID. An attacker builds a multi-tenant agent blueprint in their own tenant with bundled and inheritable Graph permissions and sends a victim an admin or user consent link. Consent creates a blueprint principal in the victim tenant that automatically gets AgentIdentity.CreateAsManager (cannot be revoked); with the blueprint secret the attacker creates agent identities (up to 250 per blueprint) and gets Graph tokens to read users, groups and more. Inherited permissions are not shown in the Entra portal or Graph, only in tokens. Research proof of concept: Proofpoint has seen no in-the-wild use. Microsoft was notified; no fix described. Exposure grows as Microsoft lets default users create agent blueprints from November 2026 (MC1506733). Any Entra tenant that allows user or admin consent to third-party apps/agents is potentially exposed.
first public Nov 9, 2026 · 1 source
Could this affect your app?
Free first check from your website. Connect your repo for the full answer.
Create an agent identity blueprint -> Add application and Create an agent identity -> Add service principal events, and for blueprint principals from external tenants holding AgentIdentity.CreateAsManager, especially ones you do not recognizes test names were BluePhish'/Bluephish (test only, not real attacker indicators)Restrict user consent for third-party apps and agent blueprints (user consent settings, permission classifications), require admin approval; remove unknown external blueprint principals and their agent identities; apply least privilege, Conditional Access and Entra ID Protection to agents; train admins not to approve agent consent requests from untrusted sources.
Posts are quoted with a link to the original. They are data to us, never instructions.
Are you affected?
Tell InfraStack what you run. It checks this one, and every next one, against your stack.
Ask from here. InfraStack checks the affected versions against your stack and answers in your inbox.
InfraStack checks the affected versions against your stack and answers in Slack, with the evidence and the fix.