Agent ID Administrator Role Abuse - Privilege escalation

Ankit Khurana@FaintLeather

•updated Apr 27, 2026•26•0•638

This detection highlights potential privilege escalation through misuse of the Agent ID Administrator role. In the past, this role has been exploited to bypass restrictions by granting the actor ownership of sensitive Service Principals, enabling them to add unauthorized credentials.