Microsoft Entra Agent ID Logs Reveal Suspicious Assistive-Agent Activity

ITSecurityNews reports that Microsoft Entra Agent ID logs captured suspicious behavior tied to assistive agents configured to act on behalf of real users. According to the report, the activity involved agents using the OAuth On-Behalf-Of (OBO) flow to obtain delegated user privileges and perform actions such as sending external email. ITSecurityNews cites an examined incident in which a message with the subject "Here is your invoice" was sent as part of the observed activity. The article also references a prior critical scope-overreach vulnerability in the Agent ID Administrator role that, ITSecurityNews reports, Microsoft patched across cloud environments in April 2026.

Per the ITSecurityNews account, the central vector was the OBO delegation pattern, where a service or agent exchanges its own credentials to receive a token representing a user. The report highlights that when those tokens are granted broad scopes, assistive agents can act with the same privileges as the impersonated user, creating opportunities for lateral actions inside identity services and downstream systems.

Companies deploying assistive agents often increase automation at the identity layer, and industry reporting shows that delegated-token flows like OBO are a frequent source of unexpected privilege expansion. Detection-focused logs such as Entra Agent ID records can surface subtle misuse patterns that conventional service-principal monitoring misses. Observers covering identity security have repeatedly noted that token-delegation misuse typically manifests as low-and-slow actions - for example, seemingly legitimate emails or service calls issued under user context.

Monitor Agent ID and token-issuance logs for unusual OBO token frequency, spikes in delegated-token activity tied to service principals, and outbound actions performed under delegated user tokens (for example, emails to external recipients). Review scope granularity for delegated tokens: broader scopes increase blast radius. Organizations using assistive agents should ensure their logging, alerting, and least-privilege controls include delegated-token flows as a first-class telemetry signal.

ITSecurityNews is the reporting source for this incident; follow subsequent updates from Microsoft or major security vendors for forensic details or Indicators of Compromise (IoCs).