Entra Agent Blueprint Credential Injection via addPassword Graph API
Detects attempts to inject attacker-controlled credentials into Entra ID Agent Blueprints via the Microsoft Graph addPassword endpoint. This activity is identified by monitoring Microsoft Graph activity logs for 'addPassword' requests and correlating with Audit Logs for 'Add password' operations targeting resources containing 'blueprint' or 'Blueprint', or where modified properties include 'Blueprint Secret', 'passwordCredential', 'addPassword', or the actor has the 'Agent ID Administrator' role.
Microsoft Sentinel (KQL)
