Organizations that use Microsoft Entra Agent ID should lock down who can approve third-party AI agents. Researchers at Proofpoint described a phishing method, dubbed BluePhishing, that gets a malicious agent template approved through a real Microsoft page.
Entra Agent ID lets companies give AI agents their own digital identities and set what data and services each can reach. Because Microsoft expected organizations to run dozens or even hundreds of agents, it added "blueprints", templates that stamp out multiple agent identities, each with its own permissions.
The attacker builds a blueprint in a Microsoft environment they control, sets its credentials and requested permissions, and makes it approvable by other organizations. They then send the victim a link to a legitimate Microsoft authorization page, by email, social network or messaging app. The attacker needs the target's tenant ID (the identifier for a company's Microsoft environment) and details of a specific user.
If the victim approves, the blueprint lands inside the organization. Organization-wide application permissions require an admin to approve. Ordinary users may be able to approve some delegated permissions, depending on company policy. The blueprint then receives a permission called AgentIdentity.CreateAsManager, which lets the attacker create more identities tied to it. One blueprint supports up to 250. The attacker collects access tokens for each and can pull data from whatever they reach.
The notable part is that the usual advice fails. There is no fake login page to spot, so the weak point is the approval decision itself. That puts this in the same family as third-party app consent abuse, and Proofpoint says the same consent settings extend to agent blueprints. The research describes a possible attack path, not a confirmed campaign.
Proofpoint recommends restricting third-party agent consent, applying least privilege (granting only the access a task needs) through Conditional Access policies and Entra ID protection for agents, and watching the audit log, where agent and blueprint events appear much like app consent operations.
One detail cuts both ways. A blueprint's ID stays the same across every tenant that consents, so defenders can hunt for a known bad one. It also means a single malicious blueprint can be reused against many organizations.