Critical Azure AD Vulnerability Lets Attackers Hijack Service Principals

Key Takeaways

• A critical vulnerability was discovered in Microsoft Entra ID’s new Agent ID Administrator role.
• The flaw allowed individuals with this role to hijack any service principal within a tenant, leading to potential widespread privilege escalation.
• The vulnerability stemmed from an unintended interaction between agent identities and standard application primitives.
• Microsoft has fully patched this behavior across all cloud environments as of April 2026.
• Organizations should still proactively identify and secure service principals with high-level directory roles.

A significant security flaw has been identified within the Microsoft Entra Agent Identity Platform, specifically concerning the recently introduced Agent ID Administrator role. This critical vulnerability enabled accounts assigned this role to seize control of arbitrary service principals, thereby facilitating extensive privilege escalation across an entire tenant.

Microsoft has confirmed and fully deployed a fix for this issue across all its cloud environments as of April 2026.

Understanding the Privilege Boundary Breach

The Microsoft Agent Identity Platform, currently a preview feature, is designed to furnish artificial intelligence agents with distinct identities, leveraging blueprints, agent identities, and agent users. To manage these non-human entities, Microsoft rolled out the Agent ID Administrator role. Microsoft’s official documentation explicitly states that this role was intended to be narrowly focused, granting permissions solely for the management of agent-related objects. For more details on role permissions, refer to the Microsoft documentation.

However, a critical discrepancy emerged due to the underlying architecture: agent identities are constructed upon existing standard application and service principal primitives. This foundational link inadvertently created a security gap.

Researchers at Silverfort discovered that actions permissible for the Agent ID Administrator role, such as updating agent identity owners, could be exploited. This allowed an administrator to modify the ownership of any service principal present within the tenant. Consequently, a user with the Agent ID Administrator role could assign themselves as the owner of a completely unrelated, highly privileged service principal.

Once ownership was successfully transferred, the malicious actor could then generate new authentication credentials and impersonate the targeted application. If the compromised service principal possessed elevated directory roles or broad Graph API permissions, this takeover mechanism offered a direct route to a comprehensive compromise of the entire environment. Silverfort’s research provides further insights into this vulnerability: Agent ID Administrator Scope Overreach & Service Principal Takeover in Entra ID.

Attackers exploiting such a vulnerability would naturally prioritize the most powerful non-human identities within a network. According to Silverfort’s findings, organizations should proactively identify service principals with administrative-level directory roles and implement appropriate security measures to protect them. Administrators can leverage the Azure CLI in conjunction with jq to query the Microsoft Graph API for these potentially vulnerable configurations. The following script can be used to discover service principals assigned privileged directory roles:

BASE="https://graph.microsoft.com"
roles="$(az rest -m GET --url "${BASE}/beta/roleManagement/directory/roleDefinitions?$filter=isPrivileged eq true&$select=id,displayName" -o json)"
u="${BASE}/beta/roleManagement/directory/roleAssignments?$expand=principal($select=id,displayName)&$top=999"
{
echo -e "SP_NAMEtSP_IDtROLE"
echo -e "--------t------t----"
while :; do
j="$(az rest -m GET --url "$u" -o json 2>/dev/null)" || break
jq -r --argjson roles "$roles" '
($roles.value | map(select(.displayName|test("Reader";"i")|not) | {key:.id, value:.displayName}) | from_entries) as $r
| .value[]
| select(.principal."@odata.type"=="#microsoft.graph.servicePrincipal")
| select($r[.roleDefinitionId] != null)
| [.principal.displayName, (.principal.id // .principalId), $r[.roleDefinitionId]] | @tsv
' <<<"$j"
u="$(jq -r '."@odata.nextLink"//empty' <<<"$j")"
[[ -z "$u" ]] && break
done | sort -t$'t' -k1,1
} | column -t -s $'t'

Microsoft has acknowledged the flaw and implemented a fix that specifically prevents the Agent ID Administrator role from managing the owners of service principals not directly associated with agents.

While the immediate threat posed by this specific vulnerability has been addressed, the broader risk of service principal ownership abuse remains a highly attractive attack vector. Security teams must maintain vigilance by actively monitoring audit logs for any successful events involving the addition of owners or credentials to service principals. Given that many tenants likely contain at least one privileged service principal, treating these identities as critical infrastructure is paramount for preventing future privilege escalation attacks.

What You Should Do

• Verify Patch Application: Confirm that your Microsoft Entra ID environment has received the latest updates as of April 2026.
• Audit Agent ID Administrator Roles: Review all accounts assigned the Agent ID Administrator role and ensure their necessity and proper scope.
• Identify Privileged Service Principals: Use the provided script or other tools to discover all service principals with high-level directory roles or significant Graph API permissions.
• Monitor Audit Logs: Implement continuous monitoring for audit logs related to changes in service principal ownership or credential additions.
• Implement Least Privilege: Enforce the principle of least privilege for all service principals, granting only the necessary permissions for their functions.

Disclaimer: HackersRadar reports on cybersecurity threats and incidents for informational and awareness purposes only. We do not engage in hacking activities, data exfiltration, or the hosting or distribution of stolen or leaked information. All content is based on publicly available sources.