# Microsoft Entra Agent ID Administrator Scope Overreach

- **Artifact ID:** CHQ-EX-2026-019
- **Public record:** https://record.cybersecurityhq.com/exhibits/chq-ex-2026-019
- **Machine-record SHA-256:** `6d58f7c36bfb5fa4925d4e979b0c5a37cc6d512db8c482679c56abc121a99e1e`

## Complete structured record

```json
{
  "id": "CHQ-EX-2026-019",
  "title": "Microsoft Entra Agent ID Administrator Scope Overreach",
  "subtitle": "The Microsoft Entra Agent ID Administrator role, scoped in documentation and product surface area to the management of AI agent identities, exercised implicit authority over arbitrary non-agent service principals across the entire tenant, enabling full service principal takeover from a role that appeared low-privilege in the administrative interface.",
  "classification_notice": [
    "This document is published as a CHQ Exhibit. It records historical conditions, breach events, and industry practices as they existed during the periods described. This Exhibit records observed conditions, exploitation mechanics, and structural patterns as documented in public disclosures, security research publications, and vendor advisories during the stated period.",
    "This document does not address present conditions and carries no current applicability. No evaluation of past practices is intended or implied.",
    "CHQ Exhibits are not superseded by later artifacts unless explicitly invalidated for factual error."
  ],
  "metadata": {
    "artifact_class": "EXHIBIT",
    "temporal_scope": "OPERATIONAL (MARCH 1 – APRIL 23, 2026)",
    "authority_level": "NON-JUDGMENTAL",
    "reliance_status": "EXHIBIT_ONLY",
    "update_policy": "ERRATA_ONLY",
    "temporal_start": "2026-03-01",
    "temporal_end": "2026-04-23"
  },
  "sections": [
    {
      "heading": "I. Factual Record",
      "content": [
        "Vulnerability: Microsoft Entra Agent ID Administrator role scope overreach. Discovered and reported by Silverfort security researchers Noa Ariel and Yoav S to Microsoft Security Response Center on March 1, 2026. The Agent ID Administrator role was scoped in Microsoft documentation and the Entra administrative interface to management of AI agent identities — agent blueprints and agent identity assignments.",
        "Mechanism: The role implementation granted the holder ownership transfer authority over arbitrary service principals across the tenant, including service principals unrelated to AI agent identities. A holder of the Agent ID Administrator role could take ownership of any service principal, then add credentials to it, then authenticate as that service principal. Result: full service principal takeover with no warning surface in the Entra administrative interface, no documentation of the capability, and no privileged-role indicator.",
        "Population Exposure: Silverfort assessment indicated approximately ninety-nine percent of Microsoft Entra tenants have at least one privileged service principal, and over fifty percent of tenants had begun using agent identities at the time of disclosure. The exposure surface was effectively the entire population of organizations adopting Microsoft’s AI agent identity management features.",
        "Remediation: Microsoft patched the role implementation across all cloud environments on April 9, 2026. The patch blocked the Agent ID Administrator role from managing owners of non-agent service principals. The fix was deployed prior to public disclosure.",
        "Disclosure: Silverfort published technical analysis on April 23, 2026, after Microsoft confirmed the patch had reached all environments. No exploitation in the wild was confirmed.",
        "Documentation State at Disclosure: Microsoft updated role documentation and the privileged-role indicator surface at the time of patch deployment to reflect the actual scope of the role."
      ]
    },
    {
      "heading": "II. Failure Pattern",
      "content": [
        "The exhibit documents a structural failure mode distinct from the credential theft and supply chain operations of contemporaneous TeamPCP campaigns. No vulnerability in the conventional sense was exploited. The role implementation matched its declared design at the level of code that ran at runtime. The failure was that the role’s actual authority did not match its documented scope, its administrative interface presentation, or the operator mental model of what the role governed.",
        "This is a governance-layer failure rather than a code-layer failure. The Entra Agent ID Administrator role is part of an identity governance system whose function is to define and enforce what authority each principal holds. The system defined the role one way in the operator-facing surface and granted it different authority at the enforcement layer. The two surfaces diverged.",
        "The structural significance is the formation mechanism. Identity governance systems are increasingly composing authority relationships across abstract identity primitives — agent identities, service principals, workload identities, managed identities, federated credentials — that share underlying infrastructure. When governance roles are built on top of shared primitives without strict scoping enforcement at the primitive layer, the governance role inherits authority across primitives it was not designed to govern.",
        "This is distinct from misconfigured permissions. A misconfigured role has been granted authority a human operator should not have granted. The Agent ID Administrator scope overreach was not configuration. The authority was a property of the role implementation, not a property of any operator’s choice. Role review processes that examine role assignments would not have surfaced the issue.",
        "The blast radius operated through the management plane rather than through credential compromise or runtime exploitation. A holder of the Agent ID Administrator role in a tenant with privileged service principals had a path to authenticate as those service principals through entirely legitimate Entra operations: ownership transfer, credential addition, authentication. Each individual operation was an authorized capability of the role at the enforcement layer.",
        "The pre-disclosure remediation eliminated the immediate exposure but does not retire the structural condition. The mechanism by which AI identity governance roles can compose authority across non-agent infrastructure remains a property of the architecture wherever new agent identity governance roles are created."
      ]
    },
    {
      "heading": "III. Referenced By",
      "content": [
        "CHQ-P-2026-014 — Position: Management Plane Compromise Produces Deterministic Control That Operates Outside Identity Enforcement.",
        "CHQ-P-2026-009 — Position: Identity Systems Are Becoming the Execution Control Plane of Enterprise Security.",
        "CHQ-SC-2026-002 — Condition: Management Plane Concentration.",
        "CHQ-SC-2026-001 — Condition: Trust Boundary Inversion.",
        "CHQ-ED-2026-017 — Evidence Docket: CHQ-P-2026-014 (Management Plane Compromise)."
      ]
    }
  ],
  "closing_statement": "This Exhibit records historical conditions. It carries no present applicability. No judgment is made about any organization, vendor, security posture, or attribution conclusion.\n\nTemporal scope: March 1 – April 23, 2026. Exhibit issuance date is May 4, 2026. This Exhibit records findings as reported by named security research organizations, not as established fact.\n\nSources: Silverfort security research publication, Microsoft Security Response Center advisory, The Hacker News, SC World.",
  "hash_scope": "Full exhibit content body",
  "hash_generated": "2026-05-04"
}
```