A demonstrated consent-abuse path
Proofpoint’s BluePhishing research describes social engineering against Microsoft Entra agent-blueprint consent. It is a proof of concept: the researchers explicitly say they have not identified in-the-wild activity. The distinction is central. This is an emerging identity-governance risk demonstrated by researchers, rather than a report of a confirmed ongoing campaign. Proofpoint
A blueprint defines an agent template; a blueprint principal represents it in a tenant; agent identities are derived instances. Proofpoint demonstrates how consent to an attacker-controlled blueprint can create a principal in a victim tenant and enable creation of local agent identities. The resulting access is constrained by permissions and the consent path, rather than automatically granting unrestricted tenant control. Proofpoint
Administrator and user consent are different
The report distinguishes application permissions requiring administrator consent from delegated permissions operating in a user context. Its broader application-permission scenario requires the phished person to have authority to grant that consent. Delegated permissions have additional flow constraints; an ordinary user accepting a prompt should not be described as equivalent to an administrator granting tenant-wide application access. Proofpoint
Proofpoint also describes visibility limitations around inherited permissions and differences observed between consent paths. TIR’s assessment is that defenders should explicitly document which objects, grants and token claims their investigation can inspect. An empty view in one management surface is not a complete permission inventory.
Investigate identities and authorisation together
Begin by recording the blueprint identifier, the resulting tenant-local identities, their creation times and the consent events that authorised them. Compare these with the organisation’s approved agent deployments and sponsors. An unfamiliar identity requires investigation; its name or autonomous behaviour alone does not establish maliciousness.
Proofpoint notes that blueprint identifiers remain consistent across consenting tenants and that agent-related events appear in audit logs. These properties can support a search for a specifically identified malicious blueprint. They do not replace investigation of the permissions granted and activity performed. Proofpoint
Practical controls
Review who can approve third-party consent, the permissions users may approve, and the escalation route for administrator requests. Ensure agent deployment has an accountable owner and a recorded business purpose. Evaluate the relevant agent-aware identity controls against the licensing and capabilities available in the tenant.
For a confirmed malicious deployment, coordinate removal or restriction of the affected identities with an assessment of tokens, granted access and follow-on activity. Changing a human user’s password alone does not demonstrate that an attacker-controlled identity has lost access. Preserve the consent and identity records before remediation where the incident-response process permits it.
This research does not establish a new CVE, a universal MFA bypass or an unrestricted takeover from any consent click. Its value is in making a specific consent and identity lifecycle visible enough to govern and investigate.
