Security researchers have revealed a novel attack technique called BluePhishing, which could allow hackers to hijack Microsoft Entra AI Agents and gain access to enterprise systems—no stolen passwords needed. The method centers on abusing Microsoft Entra Agent ID, a framework that gives AI agents their own identity in corporate cloud environments, enabling them to inherit permissions in ways that may bypass traditional security controls.
What Is BluePhishing and How It Works
BluePhishing builds on a prior phishing style involving OAuth consents, but shifts focus to Entra’s AI agent model. Attackers create an agent blueprint in their own tenant, attach a client secret, and set the sign-in audience to include other organizations—a setting not visible in the Entra portal but accessible via Microsoft Graph or PowerShell tools. These blueprints are then given wide-ranging permissions, enabling the resulting agent identities to inherit powerful access rights once deployed.
The attacker then sends a consent link to a target in another organization. If the recipient approves it, a blueprint principal is adopted in their tenant and is granted the AgentIdentity.CreateAsManager permission, which research indicates cannot be revoked. Possessing this permission, the attacker can generate agent identities within the victim’s tenant. The minimal requirements are the attacker-controlled blueprint’s ID and secret, the victim’s tenant ID, and a user sponsor. These are relatively accessible: the tenant ID is often publicly discoverable, and the blueprint’s credentials are created by the attacker.
Potential Impact and Exposure
Once inside, the attacker’s agent identity could hold sensitive permissions like User.Read.All and Group.Read.All, enough to extract organization-wide data. Because a single blueprint can spawn up to 250 agent identities, the scope of compromise—or blast radius—can be much larger than with traditional app registrations, which translate to one service principal per tenant.
This specific technique has not yet been observed in real-world attacks; it remains a proof-of-concept developed by security firm Proofpoint, shared on November 9, 2026. The firm disclosed its findings to Microsoft prior to public release. Coincidentally, Microsoft is scheduled to enable default blueprint creation for all regular Entra users later in November 2026, which could make Misuse easier if safeguards are not in place.
Why It’s Hard to Spot and How to Mitigate
Entra agents are expected to act autonomously, meaning their operations tend to blend into normal system activity. Since Entra’s portals and current Graph API tools do not reveal inherited permissions clearly—only manifesting within runtime tokens—defenders may find it difficult to detect illegitimate activity based on permissions alone.
Researchers recommend several steps to guard against BluePhishing risks:
- Train employees to scrutinize consent requests from third-party agents.
- Apply user consent policies to blueprints and agent identities just as strictly as for traditional apps.
- Enforce least privilege principles, using Conditional Access and Entra ID Protection for agents.
- Consistently monitor logs for events such as “Add application” (blueprint creation) and “Add service principal” (agent identity creation).
- Classify permissions carefully; Microsoft already blocks especially risky Graph permissions for agents, like
User.ReadWrite.All.
Indicators of Compromise
Key signs of a BluePhishing attack include seeing agent blueprints that carry the AgentIdentity.CreateAsManager permission, the blueprint’s signInAudience set to AzureADMultipleOrgs, and audit log entries for blueprint or service principal creation. An agent identity carrying broad Graph permissions such as User.Read.All or Group.Read.All is also a red flag.
This type of consent-based attack isn’t entirely unprecedented. Similar methods, like “CoPhish Copilot Studio,” have used trusted-looking agents to mislead victims into granting permissions. BluePhishing builds on these by exploiting the agent identity model itself, making it potentially harder to distinguish legitimate from malicious agents.
All of this is emerging against the backdrop of Microsoft’s move to enable blueprint creation by regular Entra users by default in November 2026. That change amplifies the risk of unauthorized consent requests slipping in under the radar.
What this means: BluePhishing represents a growing threat in identity and access management, particularly in AI-driven cloud environments. Organizations must adapt their security playbooks—review consent policies, enforce least privilege, and improve visibility—before these vectors become widespread. Going forward, we’ll be watching how Microsoft updates its controls around blueprint creation and agent permission transparency, and whether real-world attacks emerge.
