--- title: Entra Agent Attack Paths in BloodHound | daily.dev description: SpecterOps introduces an Entra Agents extension for BloodHound Enterprise that models AI agent identities (Entra Agent ID, Copilot Studio, Power Automate, and... canonical: https://daily.dev/posts/entra-agent-attack-paths-in-bloodhound-bani4amup twitter:card: summary_large_image twitter:site: @dailydotdev og:type: website og:site_name: daily.dev og:title: Entra Agent Attack Paths in BloodHound | daily.dev og:description: SpecterOps introduces an Entra Agents extension for BloodHound Enterprise that models AI agent identities (Entra Agent ID, Copilot Studio, Power Automate, and... og:url: https://daily.dev/posts/entra-agent-attack-paths-in-bloodhound-bani4amup og:image: https://api.daily.dev/og/posts/baNI4AmuP.png og:image:alt: Entra Agent Attack Paths in BloodHound og:image:width: 1200 og:image:height: 630 og:locale: en --- > ## Documentation Index > Fetch the complete documentation index at: https://daily.dev/llms.txt > Use this file to discover all available pages before exploring further. # Entra Agent Attack Paths in BloodHound **[SpecterOps](https://daily.dev/sources/specterops)** · 12 min read · 0 upvotes · 0 comments ## Summary SpecterOps introduces an Entra Agents extension for BloodHound Enterprise that models AI agent identities (Entra Agent ID, Copilot Studio, Power Automate, and select Azure AI Foundry relationships) as part of the enterprise attack graph. The core problem addressed: the identity invoking an agent is often not the identity the agent acts as, creating access-divergence paths where low-privileged users can trigger agents that act with maker-provided or shared credentials, sometimes bypassing authentication entirely. The extension traces relationships like AZAgent_ActsAs, agent identity blueprints, and cross-graph links to Entra service principals, allowing defenders to find compromise paths through agent execution-context changes rather than reviewing configurations in isolation. Coverage is intentionally conservative, only modeling relationships with defensible, validated semantics. ## Full article daily.dev links to this article rather than hosting it. Read it at the original source: ## Questions this post answers ### Why does a low-privileged user invoking a Copilot Studio agent matter for security even if they lack direct access to sensitive resources? Because the agent can authenticate to downstream services using the maker's credentials rather than the invoking user's, creating an access-divergence path. Microsoft's Copilot Studio documentation confirms that with maker-provided credentials, the agent uses the maker's identity for outbound actions, so a low-privileged invoker gains indirect access to whatever the maker can reach, independent of their own permissions. _Teams tracking identity risks across AI agent platforms can follow this kind of research on daily.dev._ ### What happens if an Entra Agent ID blueprint is compromised? Compromising a blueprint can expose every child agent identity it owns, not just one identity. Since those child agent identities are also service principals, they can carry Azure RBAC assignments and Entra ID roles, so an attacker authenticating through a compromised blueprint can extend impact across multiple identities, tenants, and permission contexts, as demonstrated in security research on Entra Agent ID blueprint blast radius. _Anyone evaluating AI identity risk in Azure environments can keep up with findings like this on daily.dev._ ### How can a publicly accessible AI agent expose authenticated backend resources? An agent configured with no user authentication lets anonymous callers interact with it, and if that agent still uses maker-provided credentials for outbound actions, an unauthenticated caller can effectively reach resources through an authenticated identity. This anonymous-to-authenticated bridge arises from combining two individually reasonable settings (public access and a privileged outbound identity), not from either setting alone. _Security teams weighing agent authentication tradeoffs can track this space on daily.dev._ ## Similar posts on daily.dev - [SpecterOps Launches BloodHound Scentry](https://daily.dev/posts/specterops-launches-bloodhound-scentry-elqgilq7f) · Dark Reading · 0 upvotes · 0 comments - [AI Agent Identity Is Not Enough](https://daily.dev/posts/ai-agent-identity-is-not-enough-5zvzaffwc) · Medium · 0 upvotes · 1 comments - [AI Agents Are Becoming Privilege Escalation Paths](https://daily.dev/posts/ai-agents-are-becoming-privilege-escalation-paths-360gvjh8m) · The Hacker News · 0 upvotes · 0 comments --- Tags: [#ai-agents](https://daily.dev/tags/ai-agents), [#authentication](https://daily.dev/tags/authentication) [View this post on daily.dev](https://daily.dev/posts/entra-agent-attack-paths-in-bloodhound-bani4amup) ```json {"@context":"https://schema.org","@graph":[{"@type":"Organization","@id":"https://daily.dev/#organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180},"sameAs":["https://twitter.com/dailydotdev","https://github.com/dailydotdev","https://www.linkedin.com/company/daily-dev-ltd"]},{"@type":"WebSite","@id":"https://daily.dev/#website","url":"https://daily.dev","name":"daily.dev","publisher":{"@id":"https://daily.dev/#organization"},"potentialAction":{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https://daily.dev/search?q={search_term_string}"},"query-input":"required name=search_term_string"}}]} {"@context":"https://schema.org","@type":"TechArticle","headline":"Entra Agent Attack Paths in BloodHound","url":"https://daily.dev/posts/entra-agent-attack-paths-in-bloodhound-bani4amup","mainEntityOfPage":{"@type":"WebPage","@id":"https://daily.dev/posts/entra-agent-attack-paths-in-bloodhound-bani4amup"},"datePublished":"2026-08-23T12:16:30.483Z","dateModified":"2026-08-23T12:18:13.922Z","description":"SpecterOps introduces an Entra Agents extension for BloodHound Enterprise that models AI agent identities (Entra Agent ID, Copilot Studio, Power Automate, and...","image":"https://media.daily.dev/image/upload/f_auto,q_auto/v1/posts/4efa92c62ede708f6672ddcc88ae118e?_a=AQAEuop","thumbnailUrl":"https://media.daily.dev/image/upload/f_auto,q_auto/v1/posts/4efa92c62ede708f6672ddcc88ae118e?_a=AQAEuop","isAccessibleForFree":true,"articleSection":"SpecterOps","inLanguage":"en","publisher":{"@type":"Organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180}},"author":{"@type":"Organization","name":"SpecterOps","logo":"https://media.daily.dev/image/upload/s--lR36Z4gn--/f_auto,q_auto/v1787487384/logos/specterops?_a=BAMAMicg0","url":"https://daily.dev/sources/specterops"},"commentCount":0,"discussionUrl":"https://daily.dev/posts/entra-agent-attack-paths-in-bloodhound-bani4amup","interactionStatistic":[{"@type":"InteractionCounter","interactionType":{"@type":"LikeAction"},"userInteractionCount":0},{"@type":"InteractionCounter","interactionType":{"@type":"CommentAction"},"userInteractionCount":0}],"keywords":"ai-agents,authentication","timeRequired":"PT12M"} {"@context":"https://schema.org","@type":"BreadcrumbList","itemListElement":[{"@type":"ListItem","position":1,"name":"Home","item":"https://daily.dev"},{"@type":"ListItem","position":2,"name":"SpecterOps","item":"https://daily.dev/sources/specterops"},{"@type":"ListItem","position":3,"name":"Entra Agent Attack Paths in BloodHound"}]} {"@context":"https://schema.org","@type":"FAQPage","@id":"https://daily.dev/posts/entra-agent-attack-paths-in-bloodhound-bani4amup#faq","mainEntity":[{"@type":"Question","name":"Why does a low-privileged user invoking a Copilot Studio agent matter for security even if they lack direct access to sensitive resources?","acceptedAnswer":{"@type":"Answer","text":"Because the agent can authenticate to downstream services using the maker's credentials rather than the invoking user's, creating an access-divergence path. Microsoft's Copilot Studio documentation confirms that with maker-provided credentials, the agent uses the maker's identity for outbound actions, so a low-privileged invoker gains indirect access to whatever the maker can reach, independent of their own permissions. Teams tracking identity risks across AI agent platforms can follow this kind of research on daily.dev."}},{"@type":"Question","name":"What happens if an Entra Agent ID blueprint is compromised?","acceptedAnswer":{"@type":"Answer","text":"Compromising a blueprint can expose every child agent identity it owns, not just one identity. Since those child agent identities are also service principals, they can carry Azure RBAC assignments and Entra ID roles, so an attacker authenticating through a compromised blueprint can extend impact across multiple identities, tenants, and permission contexts, as demonstrated in security research on Entra Agent ID blueprint blast radius. Anyone evaluating AI identity risk in Azure environments can keep up with findings like this on daily.dev."}},{"@type":"Question","name":"How can a publicly accessible AI agent expose authenticated backend resources?","acceptedAnswer":{"@type":"Answer","text":"An agent configured with no user authentication lets anonymous callers interact with it, and if that agent still uses maker-provided credentials for outbound actions, an unauthenticated caller can effectively reach resources through an authenticated identity. This anonymous-to-authenticated bridge arises from combining two individually reasonable settings (public access and a privileged outbound identity), not from either setting alone. Security teams weighing agent authentication tradeoffs can track this space on daily.dev."}}]} ```