Guest User Assigned Agent ID Administrator Role for Cross-Tenant Blueprint Abuse

Ibrahim Saud@tektrix

•updated Jun 24, 2026•0•0•1

Detects when a guest user (identified by '#EXT#' in their UPN) is assigned a sensitive role like 'Agent ID Administrator' or 'AgentAdministrator' in Entra ID. It also detects when any user, including guest users, performs modifications related to 'Agent' blueprints. This rule aims to identify potential privilege escalation or unauthorized administrative actions by external users within an Azure Active Directory environment.