Microsoft Entra Agent ID Logs Reveal Suspicious Assistive-Agent Activity
Threat-detection firm Red Canary published research showing Microsoft Entra Agent ID logs can expose AI assistive agents misusing the OAuth On-Behalf-Of (OBO) flow to send external emails under a user's identity; in one traced incident, an agent sent a message titled Here is your invoice to an external CFO-level contact, confirmed by correlating Exchange, Graph, and sign-in logs back to origin IP 51.3.97.221. Separately, security firm Silverfort disclosed a critical Entra Agent ID Administrator role flaw letting an attacker take ownership of any service principal in a tenant and authenticate as it, a full privilege-escalation path reported to Microsoft on March 1, 2026 and patched across all cloud environments by April 9, 2026.
Two separate Microsoft Entra Agent ID security findings point to the same underlying lesson: as Microsoft builds AI agents into first-class identities, the new agent-identity control plane inherits scoping gaps from the older identity primitives it is built on, and defenders need dedicated telemetry to see the difference.
What happened
Red Canary's threat detection team published research documenting how Entra Agent ID logs can reveal assistive agents (agents acting on behalf of a specific user rather than autonomously) misusing the OAuth On-Behalf-Of (OBO) flow to obtain delegated user tokens and perform actions such as sending email. In the traced incident, an email titled Here is your invoice was sent to an external, CFO-level contact via a Microsoft Graph POST to /users/{user}/microsoft.graph.sendMail; investigators confirmed the true origin IP (51.3.97.221) by correlating three log sources, the Exchange Purview send log, the Microsoft Graph Activity Log, and the non-interactive sign-in log, pivoting on AppAccessContext.UniqueTokenId and ClientRequestId. The key fields distinguishing this assistive-agent pattern from a normal service-principal sign-in were Agent.agentType = agenticAppInstance and Agent.agentSubjectType = notAgentic.
Technical context
Separately, security firm Silverfort disclosed a critical scope-overreach flaw in Entra's new Agent ID Administrator role, which is meant to manage only agent-related identity objects but could actually add ownership over any service principal in a tenant, agent-related or not. Once an attacker becomes owner of a privileged service principal, they can add new credentials and authenticate as it, what Silverfort calls full service principal takeover, a privilege-escalation path in any tenant with high-privileged service principals (Silverfort found roughly 99% of tenants have at least one, and more than half already use agent identities). Microsoft confirmed the behavior on March 26, shipped a pre-release fix April 4, confirmed the fix fully rolled out across all cloud environments on April 9, 2026, and awarded Silverfort a bug bounty.
For practitioners
These are two distinct risks in the same identity layer requiring different telemetry. Detecting assistive-agent OBO abuse requires instrumenting rules for unexpected Mail.Send Graph calls initiated by agent identities, especially where granted scopes include Mail.ReadWrite or Mail.Send or the originating IP differs from the impersonated user's normal pattern. Guarding against Agent ID Administrator-style abuse (now patched) means auditing which service principals hold privileged directory roles or high-impact Graph permissions (Directory.ReadWrite.All, RoleManagement.ReadWrite.Directory, Application.ReadWrite.All) and treating new service-principal ownership or credential changes as high-signal alerts, not routine app-admin activity.
What to watch
Confirm the April 9, 2026 patch is applied in your tenant and audit historical ownership changes on non-agent service principals made via the Agent ID Administrator role before the fix. As agent-identity roles see wider adoption, expect further research into scoping gaps where new agent-identity object types inherit permissions from older, more broadly scoped identity primitives.
Timeline
Silverfort discovers the Agent ID Administrator scope-overreach vulnerability.
Silverfort reports the flaw to Microsoft's Security Response Center.
Microsoft confirms the vulnerable behavior.
A pre-release fix reaches production and the issue is no longer reproducible.
Microsoft confirms the fix is fully rolled out across all cloud environments.
Key Points
- 1Red Canary traced an assistive-agent OAuth OBO abuse incident, an invoice-themed email sent externally, using correlated Exchange, Graph, and sign-in logs.
- 2Separately, Silverfort found Microsoft's Agent ID Administrator role could let attackers take over any service principal in a tenant, not just agent identities.
- 3Microsoft patched the Agent ID Administrator flaw across all clouds on April 9, 2026, after Silverfort's March 1 disclosure to Microsoft's security team.
Scoring Rationale
Substantially strengthened from a single aggregator writeup to three independently verified primary sources (Red Canary's original detection research, Silverfort's original vulnerability disclosure with full technical detail and confirmed timeline, and The Hacker News's independent reporting). The underlying Agent ID Administrator flaw was a genuine full-tenant privilege-escalation primitive (service principal takeover) affecting a newly-shipped Microsoft identity control plane, now patched, which is more consequential than the original single-source framing conveyed.
Sources
Public references used for this report.
Practice interview problems based on real data
1,625 SQL & Python problems across 15 industry datasets — the exact type of data you work with.
Try 250 free problems
