---
id: "TECH-202611-i5au3f"
page: "https://infrastack.ai/live/TECH-202611-i5au3f"
kind: "technique"
aliases: []
title: "BluePhishing: attackers can phish consent to a malicious Microsoft Entra agent blueprint, then create up to 250 AI agent identities in your tenant with hidden inherited permissions (Proofpoint, proof of concept)"
severity: "medium"
cvss: null
epss: null
exploited: false
status: "open"
category: "vendor"
products: [{"name": "Microsoft Entra ID", "fixed": [], "ecosystem": "saas"}, {"name": "Microsoft Entra Agent ID", "fixed": [], "ecosystem": "saas"}]
ecosystems: []
tags: ["early-warning", "technique"]
not_affected_if: []
published_at: null
first_seen_at: "2026-11-09T18:30:35+00:00"
updated_at: "2026-11-09T18:31:57+00:00"
sources: [{"source": "analyst", "url": "https://www.proofpoint.com/us/blog/threat-insight/BluePhishing-Initial-Access-via-Third-Party-Agent-Blueprint-Consent", "first_seen_at": "2026-11-09T18:30:35+00:00", "cites": ["https://www.proofpoint.com/us/blog/threat-insight/BluePhishing-Initial-Access-via-Third-Party-Agent-Blueprint-Consent"]}]
exploit_sources: []
---

# BluePhishing: attackers can phish consent to a malicious Microsoft Entra agent blueprint, then create up to 250 AI agent identities in your tenant with hidden inherited permissions (Proofpoint, proof of concept)

Link for people: https://infrastack.ai/live/TECH-202611-i5au3f (this .md is for agents)

Proofpoint (9 Nov 2026) shows OAuth consent phishing extended to Microsoft Entra Agent ID. An attacker builds a multi-tenant agent blueprint in their own tenant with bundled and inheritable Graph permissions and sends a victim an admin or user consent link. Consent creates a blueprint principal in the victim tenant that automatically gets AgentIdentity.CreateAsManager (cannot be revoked); with the blueprint secret the attacker creates agent identities (up to 250 per blueprint) and gets Graph tokens to read users, groups and more. Inherited permissions are not shown in the Entra portal or Graph, only in tokens. Research proof of concept: Proofpoint has seen no in-the-wild use. Microsoft was notified; no fix described. Exposure grows as Microsoft lets default users create agent blueprints from November 2026 (MC1506733). Any Entra tenant that allows user or admin consent to third-party apps/agents is potentially exposed.

_Summary, check and fix written by a model from the sources; labelled as such._

## Affected

- saas:Microsoft Entra ID affected range not listed fixed no fixed version listed
- saas:Microsoft Entra Agent ID affected range not listed fixed no fixed version listed

## How to check

In Entra audit logs look for 'Create an agent identity blueprint -> Add application' and 'Create an agent identity -> Add service principal' events, and for blueprint principals from external tenants holding AgentIdentity.CreateAsManager, especially ones you do not recognize. Proofpoint's test names were 'BluePhish'/'Bluephish' (test only, not real attacker indicators). Review user consent settings: does your tenant let users consent to third-party apps/agents?

## Fix

Restrict user consent for third-party apps and agent blueprints (user consent settings, permission classifications), require admin approval; remove unknown external blueprint principals and their agent identities; apply least privilege, Conditional Access and Entra ID Protection to agents; train admins not to approve agent consent requests from untrusted sources.

## Timeline

- 2026-11-09T18:30:35+00:00 analyst https://www.proofpoint.com/us/blog/threat-insight/BluePhishing-Initial-Access-via-Third-Party-Agent-Blueprint-Consent

## Documents

- [describes] @threatinsight.proofpoint.com: Proofpoint researchers identified BluePhishing, a potential attack technique tha https://bsky.app/profile/threatinsight.proofpoint.com/post/3mzvixqxcak2c
- [describes] BluePhishing: Initial Access via Third-Party Agent Blueprint Consent (Proofpoint) https://www.proofpoint.com/us/blog/threat-insight/BluePhishing-Initial-Access-via-Third-Party-Agent-Blueprint-Consent

---

_Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai_