Disclosed weakness · no CVE recorded
Third-party agent blueprints can retain delegated access after user consent
Microsoft · Microsoft Entra Agent ID agent identity blueprints
First documented disclosure · Review checkpoint
Summary
A person approving an untrusted third-party blueprint can grant access that carries over to agent identities created from it. Proofpoint demonstrated this consent risk in test tenants.
Severity and exploitation evidence
No CVSS score recorded in this review.
Exploitation not established: Proofpoint demonstrated the behavior in test tenants and reported no known in-the-wild activity.
Technical severity is not a measure of observed attacks or of risk to your deployment. Attempts, demonstrations, and successful compromise retain the qualifications in the source.
How the weakness works
The blueprint principal receives permissions approved in a tenant. Under the tested user-consent flow, agent identities could silently inherit eligible delegated permissions. Microsoft documents that both a configured scope and an actual grant are required.
Conditions required
A tenant allows the relevant consent, the user or administrator approves the third-party blueprint, and eligible permissions have been granted.
Potential impact
The blueprint owner could establish an agent identity in the consenting tenant and access resources within the granted permissions.
Affected versions and configurations
Hosted Microsoft Entra Agent ID as tested by Proofpoint. The researchers did not identify an affected version range.
Fix and mitigation status
No fixed build or vendor patch is identified. Tenant consent settings and permission review govern exposure.
Practical next steps
Limit user consent for third-party agent blueprints, review existing grants and audit new agent identities and blueprint activity.
Operating lesson
Review what approval allows future agent identities to inherit, as well as what the current identity can access.
Evidence and limits
Proofpoint describes consent abuse of an agent identity feature. This research does not establish a permission grant without approval. No CVE or vendor severity is asserted.
Related incident and research records
Related records can include laboratory demonstrations; a relationship does not itself establish exploitation.
Sources
- Proofpoint’s consent-flow research and findings from its test tenants
Primary source ·
- Microsoft documentation on grant and inheritance requirements
Primary source ·