Proofpoint Details BluePhishing Consent Abuse Against Microsoft Entra Agent Identities

Summary

Proofpoint researchers describe BluePhishing, a proof-of-concept that abuses consent to a third-party Microsoft Entra agent blueprint to create agent identities and obtain their granted permissions. Proofpoint reports no in-the-wild activity.

Key points

The proof of concept relies on socially engineering a victim into consenting to an attacker-controlled agent blueprint.
Consent creates a blueprint principal in the victim tenant with the AgentIdentity.CreateAsManager permission, which can be used to create tenant-local agent identities.
Agent identities can inherit blueprint permissions; attackers can use blueprint credentials to obtain tokens and act with the identities’ granted privileges.
A victim tenant ID and sponsor user object ID are needed; the article notes these identifiers are not considered sensitive.
Proofpoint observed silent permission inheritance for delegated permissions granted through user consent; admin-consented permissions showed a grant source of “inherited from parent.”
The researchers say inherited permissions may be difficult to audit in the Entra portal or Microsoft Graph. They recommend limiting user consent, raising awareness, applying least privilege, and monitoring agent events in audit logs.
Proofpoint describes the work as a research-based proof of concept and says it has not identified in-the-wild activity.

Article Details

Attack Vectors: Socially engineer a victim into granting consent to a malicious third-party agent blueprint through a consent link.
Configure the blueprint with application or delegated permissions, required resource access, and inheritable permissions so consented permissions can be inherited by agent identities.
Use the blueprint credentials to obtain a client-credentials token in the victim tenant, then use it to create tenant-local agent identities.
Use the blueprint credentials and an agent identity identifier to obtain a token for the agent identity and make Microsoft Graph requests with its assigned permissions.
Defensive Notes: Raise user awareness about granting consent to third-party agents from untrusted sources.
Restrict user consent and use permission classifications to limit which permissions users can approve.
Apply least privilege and use Conditional Access policies and Entra ID protection for agents.
Monitor agent and blueprint events in audit logs; the blueprint ID remains consistent across tenants that consent to it and can help identify or remove a known malicious blueprint.
Proofpoint described this as a research-based proof of concept and reported no identified in-the-wild activity at publication.