Microsoft Entra Agent ID Logs Expose Suspicious Assistive Agent Activity

Gbhackers •Mayura Kathir • June 9, 2026

Microsoft Entra Agent ID logs have exposed a subtle but consequential threat vector: assistive agents using the OAuth On-Behalf-Of (OBO) flow to act with delegated user privileges and perform potentially risky actions, such as sending external emails. In the examined incident an email with subject “Here is your invoice” was recorded in Exchange Purview as […]

The full story

This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.

Microsoft Entra Agent ID Logs Expose Risky Assistive Agent Activity Microsoft Entra Agent ID logs have revealed a significant security risk involving assistive agents utilizing the OAuth On-Behalf-Of (OBO) flow. These agents can act with delegated user privileges, potentially performing harmful actions like sending external emails. In a specific incident, an email titled 'Here is your invoice' was flagged in Exchange Purview, indicating misuse of these capabilities. Organizations relying on Microsoft Entra may be vulnerable to this threat, as it allows agents to operate under the guise of legitimate users. The investigation highlights the need for enhanced monitoring and security measures around assistive agents. Security researchers emphasize that this behavior could lead to unauthorized data exposure or phishing attempts. The current status of the threat is under investigation, with no confirmed exploitation reported yet. 2 sources 52

Extracted Entities

Platforms (3)

Exchange Purview Microsoft Entra OAuth On-Behalf-Of (obo) Flow