{"id":"TECH-202611-i5au3f","kind":"technique","aliases":[],"related":[],"title":"BluePhishing: attackers can phish consent to a malicious Microsoft Entra agent blueprint, then create up to 250 AI agent identities in your tenant with hidden inherited permissions (Proofpoint, proof of concept)","description":null,"summary":"Proofpoint (9 Nov 2026) shows OAuth consent phishing extended to Microsoft Entra Agent ID. An attacker builds a multi-tenant agent blueprint in their own tenant with bundled and inheritable Graph permissions and sends a victim an admin or user consent link. Consent creates a blueprint principal in the victim tenant that automatically gets AgentIdentity.CreateAsManager (cannot be revoked); with the blueprint secret the attacker creates agent identities (up to 250 per blueprint) and gets Graph tokens to read users, groups and more. Inherited permissions are not shown in the Entra portal or Graph, only in tokens. Research proof of concept: Proofpoint has seen no in-the-wild use. Microsoft was notified; no fix described. Exposure grows as Microsoft lets default users create agent blueprints from November 2026 (MC1506733). Any Entra tenant that allows user or admin consent to third-party apps/agents is potentially exposed.","severity":"medium","cvss":null,"epss":null,"exploited":false,"exploited_at":null,"products":[{"name":"Microsoft Entra ID","fixed":[],"ecosystem":"saas"},{"name":"Microsoft Entra Agent ID","fixed":[],"ecosystem":"saas"}],"ecosystems":[],"tags":["early-warning","technique"],"not_affected_if":[],"how_to_check":"In Entra audit logs look for 'Create an agent identity blueprint -> Add application' and 'Create an agent identity -> Add service principal' events, and for blueprint principals from external tenants holding AgentIdentity.CreateAsManager, especially ones you do not recognize. Proofpoint's test names were 'BluePhish'/'Bluephish' (test only, not real attacker indicators). Review user consent settings: does your tenant let users consent to third-party apps/agents?","fix":"Restrict user consent for third-party apps and agent blueprints (user consent settings, permission classifications), require admin approval; remove unknown external blueprint principals and their agent identities; apply least privilege, Conditional Access and Entra ID Protection to agents; train admins not to approve agent consent requests from untrusted sources.","status":"open","published_at":null,"first_seen_at":"2026-11-09T18:30:35+00:00","triaged_at":"2026-11-09T18:30:35+00:00","updated_at":"2026-11-09T18:31:57+00:00","category":"vendor","confidence":null,"triage":null,"analyst_status":"done","analyst_note":null,"search":"'-202611':33A '2026':49B,174B '250':17A,116B '9':47B 'admin':84B,183B 'agent':11A,19A,40A,58B,67B,112B,170B 'agentidentity.createasmanager':101B 'ai':18A 'allow':180B 'apps/agents':189B 'attack':2A,61B,110B 'automat':99B 'bluephish':1A 'blueprint':12A,68B,92B,107B,118B,171B 'build':62B 'bundl':74B 'cannot':102B 'concept':31A,146B 'consent':5A,52B,87B,89B,184B 'creat':14A,90B,111B,169B 'default':167B 'describ':161B 'earli':43B 'early-warn':42B 'entra':10A,36A,39A,57B,136B,177B 'expos':192B 'exposur':162B 'extend':54B 'fix':160B 'get':100B,120B 'graph':77B,121B,139B 'group':126B 'grow':163B 'hidden':25A 'i5au3f':34A 'id':37A,41A,59B 'ident':20A,113B 'in-the-wild':151B 'inherit':26A,76B,129B 'let':166B 'link':88B 'malici':8A 'mc1506733':175B 'microsoft':9A,35A,38A,56B,156B,165B 'multi':65B 'multi-ten':64B 'notifi':158B 'nov':48B 'novemb':173B 'oauth':51B 'parti':188B 'per':117B 'permiss':27A,78B,130B 'phish':4A,53B 'portal':137B 'potenti':191B 'princip':93B 'proof':29A,144B 'proofpoint':28A,46B,147B 'read':124B 'research':143B 'revok':104B 'secret':108B 'seen':149B 'send':80B 'show':50B 'shown':133B 'tech':32A 'techniqu':45B 'tenant':23A,66B,72B,97B,178B 'third':187B 'third-parti':186B 'token':122B,142B 'use':155B 'user':86B,125B,168B,181B 'victim':82B,96B 'warn':44B 'wild':154B","nicknames":["BluePhishing"],"mitigations":[],"who_affected":null,"tier":"A","verified":{},"analyst_revisit_at":null,"fix_status":null,"audience":null,"plain_action":null,"pkeys":["bluephishing","entraagentid","entraid","microsoftentraagentid","microsoftentraid"],"ptokens":["agent","entra","id","microsoft"],"labels":["earlywarning","medium","technique","vendor"],"campaign_type":"phishing","search_a":"'-202611':33A '250':17A 'agent':11A,19A,40A 'ai':18A 'attack':2A 'bluephish':1A 'blueprint':12A 'concept':31A 'consent':5A 'creat':14A 'entra':10A,36A,39A 'hidden':25A 'i5au3f':34A 'id':37A,41A 'ident':20A 'inherit':26A 'malici':8A 'microsoft':9A,35A,38A 'permiss':27A 'phish':4A 'proof':29A 'proofpoint':28A 'tech':32A 'tenant':23A","search_b":"'2026':49B,174B '250':116B '9':47B 'admin':84B,183B 'agent':58B,67B,112B,170B 'agentidentity.createasmanager':101B 'allow':180B 'apps/agents':189B 'attack':61B,110B 'automat':99B 'blueprint':68B,92B,107B,118B,171B 'build':62B 'bundl':74B 'cannot':102B 'concept':146B 'consent':52B,87B,89B,184B 'creat':90B,111B,169B 'default':167B 'describ':161B 'earli':43B 'early-warn':42B 'entra':57B,136B,177B 'expos':192B 'exposur':162B 'extend':54B 'fix':160B 'get':100B,120B 'graph':77B,121B,139B 'group':126B 'grow':163B 'id':59B 'ident':113B 'in-the-wild':151B 'inherit':76B,129B 'let':166B 'link':88B 'mc1506733':175B 'microsoft':56B,156B,165B 'multi':65B 'multi-ten':64B 'notifi':158B 'nov':48B 'novemb':173B 'oauth':51B 'parti':188B 'per':117B 'permiss':78B,130B 'phish':53B 'portal':137B 'potenti':191B 'princip':93B 'proof':144B 'proofpoint':46B,147B 'read':124B 'research':143B 'revok':104B 'secret':108B 'seen':149B 'send':80B 'show':50B 'shown':133B 'techniqu':45B 'tenant':66B,72B,97B,178B 'third':187B 'third-parti':186B 'token':122B,142B 'use':155B 'user':86B,125B,168B,181B 'victim':82B,96B 'warn':44B 'wild':154B","search_c":"","cause_entry":null,"cause_path":null,"disclosures_checked_at":null,"first_public_at":"2026-11-09T00:00:00+00:00","kev":null,"cvss_vector":null,"cvss_by":null,"poc_count":0,"sources":[{"source":"analyst","external_id":"TECH-202611-i5au3f","url":"https://www.proofpoint.com/us/blog/threat-insight/BluePhishing-Initial-Access-via-Third-Party-Agent-Blueprint-Consent","severity":null,"published_at":null,"modified_at":null,"first_seen_at":"2026-11-09T18:30:35+00:00","fetched_at":"2026-11-09T18:30:35+00:00","note":null,"cites":["https://www.proofpoint.com/us/blog/threat-insight/BluePhishing-Initial-Access-via-Third-Party-Agent-Blueprint-Consent"]}],"documents":[{"id":108758,"url":"https://bsky.app/profile/threatinsight.proofpoint.com/post/3mzvixqxcak2c","title":"@threatinsight.proofpoint.com: Proofpoint researchers identified BluePhishing, a potential attack technique tha","kind":"post","source":"bluesky","publisher":null,"text":"Proofpoint researchers identified BluePhishing, a potential attack technique that could be considered the next evolution of OAuth consent abuse. ⚠️\n\nAttackers can use Microsoft Entra’s agent identity model to gain initial access to corporate environments. www.proofpoint.com/us/blog/thre...\nhttps://www.proofpoint.com/us/blog/threat-insight/BluePhishing-Initial-Access-via-Third-Party-Agent-Blueprint-Consent?utm_source=twitter&utm_medium=social_organic\n\nlikes 0 reposts 2","published_at":"2026-11-09T18:00:07+00:00","relation":"describes","confidence":null,"note":null},{"id":108908,"url":"https://www.proofpoint.com/us/blog/threat-insight/BluePhishing-Initial-Access-via-Third-Party-Agent-Blueprint-Consent","title":"BluePhishing: Initial Access via Third-Party Agent Blueprint Consent (Proofpoint)","kind":"blog","source":"analyst","publisher":null,"text":"Proofpoint (Rachel Rabin), 9 Nov 2026. Research proof of concept, no in-the-wild activity seen. Attacker builds a multi-tenant (AzureADMultipleOrgs) Microsoft Entra Agent ID agent blueprint with required resource access and inheritable permissions, phishes admin or user consent link. Consent creates blueprint principal in victim tenant with irrevocable AgentIdentity.CreateAsManager; attacker uses blueprint client secret to create up to 250 agent identities (needs a sponsor user, removable later) and get Graph tokens (test: User.Read.All, Group.Read.All, used with GraphRunner). Inherited permissions not visible in Entra portal or Graph, only in tokens. Audit events: 'Create an agent identity blueprint -> Add application', 'Create an agent identity -> Add service principal'. Test display names BluePhish/Bluephish. Microsoft notified; MC1506733: default users can create agent blueprints from November 2026. Mitigations: restrict user consent for third-party agents/blueprints, permission classifications, least privilege, Conditional Access and ID Protection for agents, monitor audit logs.","published_at":"2026-11-09T00:00:00+00:00","relation":"describes","confidence":null,"note":null}],"disclosures":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}