Hackers Can Abuse Entra Agent ID Administrator Role to Hijack Service Principals

A scope-overreach vulnerability in Microsoft Entra Agent Identity Platform allowed the Agent ID Administrator role to modify ownership of arbitrary service principals, enabling attackers to create credentials for high-privilege applications and potentially achieve full tenant compromise; Microsoft deployed a patch in April 2026 and the report includes detection scripts and guidance to treat privileged service principals as critical assets.