BluePhishing: Proofpoint's proof of concept turns a consent link for a third-party Entra agent blueprint into tenant initial access, with an agent-creation permission that Proofpoint says cannot be revoked

Proofpoint presents BluePhishing, a proof of concept that extends OAuth consent phishing to Microsoft Entra Agent ID. The attacker builds an agent blueprint, the agent analogue of an app registration, in their own tenant with a client secret and permissions set to be inherited, sets its sign-in audience to work across tenants (a setting the Entra portal does not expose, so it takes Microsoft Graph, PowerShell or a manifest edit), and sends the victim a one-time consent link (Proofpoint, 2026-11-09). When a victim consents, a blueprint principal appears in the victim tenant with the AgentIdentity.CreateAsManager permission, which Proofpoint says cannot be revoked from the principal; the attacker then obtains an app-only Graph token for the victim tenant and creates agent identities, up to 250 per blueprint, that inherit the consented permissions (Proofpoint, 2026-11-09). Creating one needs the victim's tenant ID and the object ID of a sponsor user, both obtainable through documented unauthenticated lookups, and Proofpoint's tests used the Graph permissions User.Read.All and Group.Read.All (Proofpoint, 2026-11-09). Proofpoint, citing Microsoft's documentation, says inherited permissions are not visible in the Entra portal or in Microsoft Graph, which limits auditing what an agent identity can do; in its tests silent inheritance appeared only for delegated permissions, those granted through user consent (Proofpoint, 2026-11-09).

Proofpoint has identified no in-the-wild activity and says agent consent controls are less mature and less widely deployed than app consent controls; it adds that Microsoft 365 Message Center item MC1506733 says default Entra users will be able to create agent blueprints from November 2026 (Proofpoint, 2026-11-09).