Microsoft fixes Entra ID flaw enabling privilege escalation

Microsoft fixed a Microsoft Entra ID privilege-escalation flaw in the Agent ID Administrator role that allowed accounts with only that role to take over arbitrary service principals by assigning ownership and adding credentials, enabling full service principal compromise and potential directory-level escalation. Researchers demonstrated a PoC; Microsoft confirmed the behavior, deployed a fix that restricts the role to agent-related objects, and rolled out the patch in April 2026.