Microsoft Patches Entra ID Role Flaw That Enabled Service Principal Takeover

Silverfort reported that Microsoft Entra ID's Agent ID Administrator built-in role could be abused to become owner of arbitrary service principals and add credentials, enabling full service principal takeover and potential tenant-wide privilege escalation; Microsoft released a patch on April 9, 2026 to block assigning ownership of non-agent service principals with this role. Organizations are advised to monitor sensitive role usage, audit service principal ownership and credential creation, and secure privileged service principals to mitigate the risk.