- Proofpoint's BluePhishing proof of concept needs an administrator to consent to a malicious Entra agent blueprint. Ordinary user consent gives far narrower access.
- Proofpoint has seen no in-the-wild use. Microsoft's default change on who can create blueprints applies from November 2026, this month.
- Review who can grant admin consent, check consent settings, and watch audit logs for agent and blueprint events.
An old trick, aimed at a new kind of worker
Consent phishing works because the victim does the attacker's work. Nobody steals a password. Someone approves a request, and the attacker gets in through an identity the organisation itself approved.
Proofpoint researchers now describe a version aimed at AI agents. They call it BluePhishing. The full attack Proofpoint demonstrated needs a victim who can grant admin consent. Ordinary user consent is far more limited.
This is a research proof of concept. Proofpoint says it has not identified any in-the-wild activity.
How the attack works
Microsoft Entra Agent ID brings AI agents into Entra, Microsoft's identity system. Proofpoint describes three parts. A blueprint is the template for an agent. A blueprint principal is that template's presence inside a company's tenant, which is its own Microsoft account space. An agent identity is a working agent made from the blueprint.
The attacker builds a blueprint in a tenant they control. They switch on a setting that lets other organisations consent to it. The Entra portal does not show that setting. Graph, PowerShell or the blueprint file can change it.
Next the attacker sends a consent link. If an administrator accepts, a blueprint principal appears in the victim's tenant.
Proofpoint observed that this principal receives a permission called AgentIdentity.CreateAsManager by default. That permission lets the attacker request a Graph token inside the victim tenant. Graph is Microsoft's interface to directory data. With the token, the attacker can create agent identities there. Proofpoint says the permission cannot be revoked from the principal.
The attacker needs only a few details, such as the victim's tenant ID and a user to name as sponsor. Proofpoint says these are not considered sensitive. Public methods can find them without a login.
What the demonstration reached, and what limits it
In Proofpoint's demonstration, the created identity held User.Read.All and Group.Read.All. These let it read users and groups in the directory. Proofpoint paired the token with GraphRunner, a post-access tool, to send arbitrary Graph requests.
Proofpoint is clear about the limits. Broad application permissions need admin consent. So the phished person must be able to grant it.
A regular user can consent only to delegated permissions. These act in that user's own context. Proofpoint says they cannot run on their own without a further consent step.
Microsoft also narrows what is reachable. Proofpoint notes that Microsoft already blocks some high-risk Graph permissions for agents. One example is User.ReadWrite.All. Proofpoint told Microsoft about the attack before publishing.
Why defenders may struggle to see it
Two features meant to ease deployment cut both ways. One fixes a list of permissions up front. The other lets agent identities inherit permissions. An attacker can pack broad permissions into one consent link, and every new identity receives them.
Proofpoint cites Microsoft documentation on inheritance. It says inherited permissions do not show in the Entra portal or in Graph. They appear only in the token at runtime. Proofpoint says this could make audits harder.
People matter too. Proofpoint says awareness is low. Agents are meant to act on their own, so a broad request may look normal for an agent. Many agent identities in one environment make that easier.
Scale adds to the risk. Proofpoint says one blueprint can support up to 250 agent identities.
Proofpoint cites Microsoft Message Center item MC1506733. It says default Entra users can create blueprints by default from November 2026. That is this month. This is one research report, not evidence of a trend.
Questions to put to your identity team
Start with who can approve what. Ask how many people can grant admin consent, and how they would spot a bad request.
Ask whether user consent settings and permission classifications are tight. Proofpoint says the limits on third-party app consent also apply to agent blueprints and identities.
Ask whether anyone watches agent and blueprint events in the audit log. Proofpoint says they appear there much like app consent events.
Ask whether anyone can list every agent identity and its permissions. Proofpoint advises least privilege, plus Conditional Access and Entra ID protection built for agents.
Ask for a plan to find and remove known bad agents. The blueprint ID is the same in every tenant that consents, so one bad ID can be searched for everywhere.
Think of agent identities as employees with badges. This research suggests agents add a new approval step. Consent phishing already shows that attackers target approvals. The badge office deserves the same scrutiny as the front door.
Produced by the WebPulse Newsroom with AI assistance from the original reporting credited below, and checked against that source by our editorial review. How we use AI.
Original reporting: Proofpoint.
