Microsoft Patches Entra Flaw Allowing Service Account Takeovers
A flaw in Microsoft Entra's Agent ID Administrator role allowed users with that access to take over non-agent service principals and other software accounts inside a company's Microsoft environment, according to security researchers. The issue could be used to add credentials, change ownership and escalate privileges, including by seizing high-privilege administrator accounts, potentially giving an attacker broad control of the network while appearing legitimate.
Microsoft said it fixed the vulnerability across cloud environments on April 9, 2026. Researchers said customers should review Entra audit logs for unexpected ownership changes or newly added credentials on sensitive accounts, including "Add owner" and "Add password credential" events from the past 60 days.
From the sources (2 posts)
@thehackersnews😳 Entra ID Agent ID Administrator role flaw enabled service principal takeover. Users could take over non-agent service principals, add credentials, and escalate privileges before Microsoft’s April 9, 2026 patch. 🔗 See how the attack work
@cybernewsliveSecurity researchers found a flaw in Microsoft's system for giving AI agents their own login identities — a role called Agent ID Administrator could be abused to take over nearly any software account inside a company's Microsoft environment