An administrative role meant for AI agents within Microsoft’s Entra ID ecosystem could allow privilege escalation and tenant takeover attacks, as it had privileges over more than agent-related objects.

Researchers at Silverfort found that users assigned to Microsoft’s “Agent ID Administrator” role, scoped to agent-related objects like blueprints and agent identities, could take ownership of unrelated service principals across the tenant. These users could then attach credentials and authenticate as those applications (unrelated services) to potentially manipulate app-to-app communication inside enterprise environments.

“Prior to the fix, the Agent ID Administrator role allowed assigning ownership over service principals beyond agent-related identities, effectively enabling similar capabilities to roles such as Application Administrator, but without being scoped specifically to agent use cases,” Silverfort researchers said in a blog post.

Microsoft has reportedly patched the issue across all cloud environments, blocking the role from modifying non-agent service principals. The cloud giant did not immediately respond to CSO’s request for comments.

Agent-only briefly meant everything

The problem was a failure in scope enforcement within a new agent identity security offering.

Introduced as part of Microsoft’s push to operationalize AI agents through its Agent Identity Platform, the Agent ID Administrator role is an effort to give autonomous agents their own governed identities inside Entra ID.

The role was designed to operate within a newly introduced set of objects tied to AI agents. However, because agent identities are ultimately built on the same primitives as applications, namely service principals, the boundary between “agent” and “non-agent” objects was not properly defined.

This architectural confusion could allow role holders to add themselves as owners of a wide range of service principals across the tenant. But the same action was blocked for application objects, suggesting the flaw was specific to the service principal layer rather than the broader identity model.

Application object and service principal are two related objects created every time an application is registered in Microsoft Entra ID.

“The application object serves as the global definition of the app and describes its configuration,” the researchers explained. “The service principal represents the app as an identity within a tenant and is the object that authenticates, is assigned roles and permissions, and accesses resources.”

The lack of definition allowed privilege expansion, allowing the role to mimic capabilities of a higher-privileged role like an Application Administrator. This was happening by default and did not trigger any alarm, the researchers noted.

From principal ownership to full takeover

Once ownership of a service principal was obtained, the attacker could generate new credentials like client secrets or certificates, and use them to authenticate as the compromised application. If the application held elevated directory roles or sensitive API permissions, the attackers could inherit those privileges.

“The impact depends on the privileges assigned to the targeted service principal,” the researchers said. “In environments where service principals are widely used or hold elevated permissions, this can lead to significant escalation. Tenant posture can further influence the impact, for example in cases of broadly consented applications or permissive configurations.”

The researchers noted that Agent ID Administrator is fairly new and isn’t in wide use yet, but the service principal-based escalation path is. “About 99% of tenants have at least one privileged service principal (not necessarily agent-related),” they said. Of them, more than half use agent identities averaging around 100 per tenant, creating a “real risk.”

Microsoft Security Response Center (MSRC) told Silverfort that an internal fix was fully rolled out by April 9, 2026, requiring no further user action. Researchers still published a few recommendations along with detection steps to help users identify and respond to similar patterns.