Investigating suspicious AI workflows in Microsoft Entra Age...

[carlospolop]

🤖 Automated Content Update

This PR was automatically generated by the HackTricks News Bot based on a technical blog post.

📝 Source Information

• Blog URL: https://redcanary.com/blog/threat-detection/entra-id-ai-workflows-teams/
• Blog Title: Investigating suspicious AI workflows in Microsoft Entra Agent ID: Agent's user account
• Suggested Section: Azure Pentesting > Az - Services > Az - Entra ID (AzureAD) & Azure IAM, with cross-reference to Az - Post Exploitation or a new subsection for Entra Agent ID / AI Agent Identities

🎯 Content Summary

The post is not a CVE write-up or a software bug exploit. It is a technical detection and investigation walkthrough showing how a Microsoft Entra Agent ID agent user can send Microsoft Teams messages through OAuth/Microsoft Graph, how that activity appears across Microsoft logs, and how defenders can correlate Purview Teams audit events, MicrosoftGraphActivityLogs, and AADNonInteractiveUserSignInLogs to reconstruct the real identity, authentication path, sourc...

🔧 Technical Details

Abusing the Entra Agent ID agent-user OAuth flow to act as an agent user: If an operator has the target tenant ID, blueprint client secret, blueprint ID, target child agent identity ID, and linked agent user UPN, they can perform the Entra Agent ID token-exchange flow to obtain a Microsoft Graph token for that agent user. First, request an exchange token from https://login.microsoftonline.com/$TargetEntraTenantID/oauth2/v2.0/token using client_id=$BlueprintID, client_secret=$BlueprintSecret, fmi_path=$TargetAgentIdentityId, grant_type=client_credentials, and scope=api://AzureADTokenExchange/.default. Second, request an agent identity token using client_id=$TargetAgentIdentityId, scope=api://AzureADTokenExchange/.default, client_assertion_type=urn:ietf:params:oauth:client-assertion-type:jwt-bearer, client_assertion=$($Token.access_token), and ...

🤖 Agent Actions

Done — I updated:

• src/pentesting-cloud/azure-security/az-services/az-azuread.md

Added a new section for:

• Entra Agent ID agent-user OAuth impersonation
• Using the resulting Graph token to send Teams messages
• Hunting/correlation via AppAccessContext.UniqueTokenId → MicrosoftGraphActivityLogs / AADNonInteractiveUserSignInLogs
• Response actions to soft-delete the Teams message or disable the agent user

I also added references for:

• Red Canary blog
• Official Microsoft Learn Entra Agent ID docs

Validation:

• Reviewed the diff and placement
• Confirmed the content is only added once in a single file
• mdbook build could not be run because mdbook is not installed in this environment

---

This PR was automatically created by the HackTricks Feed Bot. Please review the changes carefully before merging.

[carlospolop]

🔗 Additional Context

Original Blog Post: https://redcanary.com/blog/threat-detection/entra-id-ai-workflows-teams/

Content Categories: Based on the analysis, this content was categorized under "Azure Pentesting > Az - Services > Az - Entra ID (AzureAD) & Azure IAM, with cross-reference to Az - Post Exploitation or a new subsection for Entra Agent ID / AI Agent Identities".

Repository Maintenance:

• MD Files Formatting: 585 files processed

Review Notes:

• This content was automatically processed and may require human review for accuracy
• Check that the placement within the repository structure is appropriate
• Verify that all technical details are correct and up-to-date
• All .md files have been checked for proper formatting (headers, includes, etc.)

Bot Version: HackTricks News Bot v1.0