BluePhishing: How Attackers Abuse AI Agent Identity Consent

BluePhishing is the name Proofpoint’s Threat Insight team gives to a new way into a Microsoft 365 tenant. Proofpoint describes it as the next step in OAuth consent phishing, built around Microsoft Entra’s new Agent Identity framework instead of a normal app registration.

Proofpoint published the research on 9 November 2026. The researchers call it a research-based proof of concept and say they have not identified any in-the-wild use of the technique. They also say they notified Microsoft about the attack before publishing the details.

What Is Microsoft Entra Agent Identity?

Microsoft Entra Agent ID is Microsoft’s identity framework for AI agents. Proofpoint says it closely mirrors the existing application model in Entra, and inherits many of the same ways that model can be abused.

An agent blueprint is the template for an agent, similar to an app registration. A blueprint principal represents that blueprint inside a tenant once it is consented to, similar to a service principal. An agent identity is one instance created from a blueprint.

Primer

• Agent blueprintThe template for an agent, similar to an app registration, created in the attacker’s own tenant.
• Blueprint principalThe object a blueprint creates inside a tenant that consents to it, similar to a service principal.
• Agent identityOne instance created from a blueprint, carrying its own permissions.
• Inheritable permissionsA setting that lets permissions granted once at the blueprint level pass automatically to every agent identity made from it.

Microsoft’s own documentation on required resource access and inheritable permissions explains why the design works this way. Inheritable permissions let an administrator approve a resource once at the blueprint level. That approval then applies to every agent identity later created from the same blueprint, without asking again.

Microsoft’s service-limits documentation says each agent blueprint managed by a platform it does not own is capped at 250 agent identities per tenant. Proofpoint treats this as the attack’s blast radius: one consented blueprint can still reach 250 separate agent identities inside the victim.

How Does the BluePhishing Attack Work?

Proofpoint names the technique BluePhishing because it extends classic OAuth consent phishing into the agent identity model. Classic OAuth consent phishing gets a victim to approve a malicious app registration.

The researchers say an attacker first configures an agent blueprint in a tenant they control. They set required resource access on it and mark the resource as inheritable. The attacker then sends the victim a one-time consent link for that blueprint.

1. Blueprint configuredAttacker Tenantsends consent link
2. Victim grants consentConsentcreates blueprint principal
3. Blueprint principal createdVictim Tenantcan create agent identities
4. Agent identity createdVictim Tenantinherits blueprint permissions
5. Access token obtainedMicrosoft Graph

Proofpoint says the blueprint principal created at consent automatically receives an application permission, AgentIdentity.CreateAsManager. The researchers say this permission cannot be removed from the principal once it exists. They say it is what lets the attacker use the blueprint’s own credentials, held in their own tenant, to create agent identities inside the victim tenant from outside it.

Once an agent identity exists in the victim tenant, Proofpoint says the attacker can obtain a Microsoft Graph access token for it. That token is scoped to whatever permissions the blueprint was granted. The attacker can then use the token with a post-access tool to act inside the victim tenant. We leave the exact request and token details Proofpoint published out of this page.

What Makes BluePhishing a Bigger Risk Than App Consent Phishing?

Proofpoint lists several reasons it treats BluePhishing as a step up from app consent phishing. The list below gives its own reasoning for each point.

• Lower user awareness. Proofpoint says people are more likely to consent to an AI agent than to a traditional app, because fewer users know agent consent carries the same risk.
• Thinner governance. The researchers say agent consent controls are less mature and less widely deployed than the equivalent app consent controls most tenants already run.
• One blueprint reaches further. An app registration maps to one service principal per tenant, but Microsoft’s own limits documentation caps a single non-Microsoft blueprint at 250 agent identities in one tenant.
• Inherited permissions are hard to see. Microsoft’s own documentation says they are not visible on agent identities in the Entra admin center or through Microsoft Graph, only in the token at runtime. Proofpoint adds that in its own testing, this silent inheritance happened only for permissions granted through user consent. Permissions granted through admin consent showed a visible “inherited from parent” source instead.

What Should Defenders Check for BluePhishing?

Proofpoint’s own advice centers on awareness and governance, not a single patch. The attack uses the consent design as Microsoft built it, not a bug in it.

The researchers recommend raising user awareness of agent consent risk, particularly for a blueprint offered by an unfamiliar third party. They point to Microsoft’s user consent settings, which already limit third-party app consent, and say these same settings extend to agent blueprints and the identities created from them.

Microsoft’s own authorization documentation lists four Graph permissions it blocks for every agent identity: Application.ReadWrite.All, RoleManagement.ReadWrite.All, User.ReadWrite.All and Directory.AccessAsUser.All. It says even a tenant administrator cannot consent to grant an agent one of these permissions.

Detection Signals to Watch

Proofpoint says the agent blueprint ID stays the same across every tenant that consents to it. It calls this a common indicator defenders can use to find or remove a known malicious blueprint once one is identified.

The researchers also point defenders to the Entra audit log. They say agent and blueprint creation events appear there in a similar way to app consent events. Conditional Access policies for agents and Entra ID Protection for agents are additional controls on what a compromised agent identity can still do.

BluePhishing extends a pattern we have covered before. Our reporting on SaaS OAuth consent phishing covers the same consent-abuse entry point without the agent identity layer. Our non-human identity glossary entry explains why identities like these are harder to govern than human accounts. Our piece on non-human identity as a growing entry point covers the wider pattern these agent identities are part of.