Key Takeaways
- A newly introduced Agent ID Administrator role in Microsoft Entra Agent Identity Platform unintentionally granted the ability to modify owners of any service principal, not just agent‑related objects.
- Because agent identities are built on standard application and service‑principal primitives, the role’s scope overlooked this inheritance, creating a critical privilege‑escalation path.
- An attacker with the Agent ID Administrator role could assign themselves as owner of a high‑privileged service principal, generate new credentials, and authenticate as that application, potentially achieving full tenant compromise.
- Microsoft has fully patched the behavior across all cloud environments as of April 2026, restricting the role to manage only agent‑related service‑principal owners.
- Despite the fix, service‑principal ownership abuse remains a high‑value attack vector; proactive monitoring of audit logs for owner or credential additions is essential.
- Organizations should regularly discover privileged service principals using tools such as Azure CLI + jq + Microsoft Graph API and treat these non‑human identities as critical infrastructure.
- SilverFort research highlights the importance of identifying service principals holding admin‑level directory roles and securing them against unauthorized ownership changes.
- Staying informed through trusted security feeds and applying least‑privilege principles to both human and non‑human accounts mitigates similar future risks.
Overview of the Vulnerability
A critical scope‑overreach vulnerability was discovered in the Microsoft Entra Agent Identity Platform, a preview feature that supplies artificial‑intelligence agents with identities via blueprints, agent identities, and agent users. To manage these non‑human entities, Microsoft introduced the Agent ID Administrator role, documented as being scoped strictly to agent‑related objects. However, researchers from SilverFort found that the role’s permissions inadvertently allowed accounts to hijack arbitrary service principals across the entire tenant, enabling privilege escalation that could lead to full environmental compromise. The issue stemmed from a mismatch between the intended role boundary and the underlying implementation that treats agent identities as standard application and service‑principal primitives.
Agent Identity Platform and the New Administrator Role
The Agent Identity Platform is designed to give AI agents a secure, manageable identity within Azure AD, letting administrators assign roles, credentials, and ownership to these agents without exposing human user accounts. Recognizing the need for a dedicated management role, Microsoft created the Agent ID Administrator role, intending it to control only agent‑specific resources such as agent identities, agent users, and associated blueprints. Documentation explicitly stated that the role would not have rights over conventional application registrations or service principals. This clear scoping was meant to limit the attack surface while providing sufficient flexibility for agent lifecycle management.
Why Agent Identities Create a Scoping Gap
Despite the documented intent, the platform’s implementation reuses the same directory objects that underpin regular applications: each agent identity is essentially a service principal with additional metadata marking it as an agent. Because the underlying object type is identical, permission checks that look only at the “agent” flag can be bypassed when the request targets the core service‑principal properties—such as the owners attribute. The Agent ID Administrator role was granted permission to modify owners on agent identities, but the authorization logic failed to verify that the target object was indeed flagged as an agent. Consequently, any service principal in the tenant, regardless of its purpose, could be treated as an agent‑owned object and have its ownership altered by a holder of this role.
How the Permission Boundary Is Bypassed
When a user assigned the Agent ID Administrator role calls the Microsoft Graph API to update an agent identity’s owners, the request is processed like any other service‑principal owner update. If the caller supplies the object ID of a non‑agent service principal—perhaps one that holds privileged directory roles such as Global Administrator or has high‑impact Graph API permissions—the service processes the request because the ownership‑modification permission is not scoped to the agent flag. The attacker can therefore add themselves as an owner of that service principal. Once ownership is established, the attacker can generate new client secrets or certificates, authenticate as the service principal, and inherit whatever permissions the principal possesses. If the compromised service principal is privileged, this yields a direct route to tenant‑wide administrative control.
Typical Attack Flow Leveraging the Vulnerability
According to SilverFort’s research, an attacker would first enumerate the tenant for service principals that hold elevated directory roles or extensive Graph API permissions—targets such as Exchange Online admin service principals, SharePoint admin accounts, or custom apps with Directory.ReadWrite.All or PrivilegedAccess.ReadWrite.AzureAD rights. Using the Agent ID Administrator role, the attacker then updates the owners property of the chosen service principal to include their own account (or a credentials‑bearing service principal they control). After the ownership change, the attacker requests a new token or creates a client secret for the compromised principal, enabling authentication as that high‑privileged identity. With those credentials, the attacker can execute any action permitted by the service principal, ranging from reading all mailboxes to modifying conditional access policies, ultimately achieving full control over the Azure AD tenant and any linked services.
Microsoft’s Patch and Mitigation Measures
Upon responsible disclosure, Microsoft investigated the scoping error and released a fix that tightens the authorization logic for the Agent ID Administrator role. The updated permission check now validates that the target object is marked as an agent before allowing owner modifications, effectively preventing the role from managing owners of non‑agent service principals. The patch has been deployed across all Microsoft cloud environments as of April 2026, and administrators no longer need to apply any manual workarounds to close this specific gap. Microsoft also updated the relevant documentation to clarify the role’s intended scope and to warn against assuming broader privileges based on the role name alone.
Continued Vigilance and Detection Strategies
While the immediate threat is neutralized, the underlying risk of service‑principal ownership abuse persists because many tenants contain at least one privileged service principal that could be targeted via other misconfigurations or compromised credentials. Security teams should therefore monitor audit logs for events such as Add owner to service principal or Add credential to service principal that originate from non‑expected principals, especially those holding the Agent ID Administrator role. Additionally, administrators can run detection scripts—like the Azure CLI + jq example provided in the original report—to periodically list service principals assigned to privileged directory roles and verify that their ownership is restricted to trusted accounts. Treating these non‑human identities as critical infrastructure, applying least‑privilege principles, and regularly reviewing ownership changes are essential steps to prevent similar privilege‑escalation techniques in the future.
Final Thoughts and Call to Action
The Agent ID Administrator over‑privilege incident underscores how reuse of foundational directory objects can unintentionally broaden the reach of narrowly scoped roles, especially when permission checks rely on supplementary flags rather than object type verification. Organizations must pair patch management with continuous monitoring, proactive discovery of privileged service principals, and strict governance over non‑human identities. By staying current with threat intelligence feeds—such as those from SilverFort, Microsoft Security Response Center, and reputable cyber‑security news outlets—and by enforcing rigorous least‑privilege policies for both human and service‑principal accounts, defenders can reduce the likelihood that a seemingly benign role becomes a gateway to full tenant compromise. Follow trusted security channels for daily updates and consider reaching out to share your organization’s experiences or lessons learned regarding identity‑based attack surfaces.