Executive Summary
Recent research highlights a sophisticated attack vector involving Microsoft Entra ID Agent Blueprints, mirroring tradecraft associated with the threat actor Midnight Blizzard. By compromising a user with the Agent ID Administrator role in a primary tenant, attackers can inject credentials into shared agent blueprints. This allows them to authenticate as any service principal or agent identity derived from that blueprint across different tenants, bypassing traditional tenant boundaries.
Technically, the attack progresses from blueprint credential injection to the discovery of subsidiary tenants via guest accounts and OpenID configuration mapping. Once the attacker identifies an agent identity in a target tenant, they use token exchange mechanisms to impersonate privileged agents. In the described scenario, this culminated in the abuse of Microsoft Graph permissions to issue a Temporary Access Pass (TAP), effectively bypassing Multi-Factor Authentication (MFA) to achieve Global Administrator status.
This method demonstrates a significant expansion of the attack surface for organizations using third-party or cross-tenant agent solutions. It highlights the critical risk of granting high-privilege permissions to agent identities, as a single blueprint compromise can lead to the total takeover of all associated environments.