BluePhishing: trace the agents created after consent

A demonstration with defined prerequisites

Proofpoint presented BluePhishing as a proof of concept for Microsoft Entra Agent ID consent abuse. Approving a malicious blueprint allows creation of agents with granted privileges. The researchers had not identified real-world use of the technique. This does not establish unrestricted tenant access.

Start acceptance before the consent button

Ask the integration owner for a record of the supplier, purpose, originating tenant, blueprint identifier and required operations. Compare those details with the request presented to the approver. An assistant’s product name helps identify the offering, but its identifier connects the request to the integration being assessed.

Microsoft’s consent controls distinguish permissions that users can approve from those requiring an administrator. Test both paths using laboratory accounts and data. A request beyond the permitted scope should produce a verifiable refusal or escalation, without assuming that every approval has the same effect.

Retain the expected result and observed evidence for each test. The approver needs a practical answer to which business task justifies the authorization and who will maintain it. This record supports a later investigation without relying on the memory of the person who clicked.

Follow the identity created by approval

The agent creation documentation describes blueprint principals able to create identities. For the implicit AgentIdentity.CreateAsManager permission, Microsoft specifies disabling or removing the principal because the permission cannot be revoked individually. This changes the containment test: removing a visible grant may leave the identity-creation path available.

Build a relationship record connecting approval, blueprint principal, derived identities and internal owner. Include identifiers and timestamps actually available in your telemetry. Do not assume they all appear in one event. Have the team demonstrate how it would recognize a new identity derived from an integration approved earlier.

Agent logs record blueprint activity as application events and identity activity as service principal events. Validate collection with a controlled operation, then check the SIEM search. The desired evidence is a repeatable investigation path across these objects, rather than an alert containing the word agent.

Compare approval with an actual operation

The inheritance documentation distinguishes configuration, grants and effective permissions in the token. Inherited permissions do not appear as permissions on the identity in the portal or Graph. Consequently, a screen without directly listed grants does not complete the access assessment.

In an authorized test environment, compare the approved set with authorization metadata presented during execution. Record identifiers and permissions needed for analysis without retaining a usable token. Perform an allowed read and a change that should fail. Capture the resource, identity, outcome and evidence in the destination application.

An accepted operation beyond the agreed scope is a concrete finding for review. A refused operation helps bound exposure, but does not establish behavior across every resource. Expand the matrix according to the integration’s business functions, prioritizing directories, documents and other data it actually uses.

Rehearse containment for the whole identity family

Select a laboratory integration and simulate withdrawing approval. Identify its principal and every known descendant, apply the defined control, and test both new identity creation and existing identities’ operations. Record separately what stopped and what still works, avoiding a purely administrative closure.

The ConnectWise application-identity analysis helps organize investigation of access that already occurred. The specific issue here is preserving the relationship between initial consent and agents created afterwards. Deliver that relationship, test results and review ownership to the person responsible for the integration.

Frequently asked questions

Related reading

• ConnectWise and Microsoft 365: response continues after disabling the app
• Microsoft Authenticator on Android: what to verify after updating
• Mittwald: from an MCP token to the projects it can reach

Sources and references

• Proofpoint: BluePhishing research and proof-of-concept limitations
• Microsoft: agent identity creation and principal controls
• Microsoft: agent permission grants and inheritance
• Microsoft: configuring user consent policies
• Microsoft: agent audit and sign-in logs

Original Pentesty analysis, published November 11, 2026. The proposed scenarios are editorial guidance, with scope and validation to be defined for each environment.