Microsoft Entra Agent ID Logs Expose Suspicious Assistive Agent Activity

Microsoft Entra Agent ID logs have exposed a subtle but consequential threat vector: assistive agents using the OAuth On-Behalf-Of (OBO) flow to act with delegated user privileges and perform potentially risky actions, such as sending external emails.

In the examined incident an email with subject “Here is your invoice” was recorded in Exchange Purview as “Send” initiated by an AgentId.

Initial fields pointed to client IP 40.126.23.26 and a user-agent string reporting PowerShell on macOS.

That view alone, however, was incomplete: AppAccessContext.UniqueTokenId and ClientRequestId were used to pivot into MicrosoftGraphActivityLogs, which confirmed a Graph POST to /users/{user}/microsoft.graph.sendMail and revealed the real origin IP 51.3.97.221.

Correlating further to AADNonInteractiveUserSignInLogs using the same unique token produced an Agent sign-in record showing Agent001 (AppId 8cd0a10f-0be8-413a-9bf2-f44bc568d1e4) obtained a token on behalf of matt@ContosoCorp.onmicrosoft.com with scopes including Mail.Send and Mail.ReadWrite.

According to Red canary, investigation demonstrates how precise cross-log correlation Purview Exchange activity, Microsoft Graph API telemetry, and Azure AD Non-Interactive sign-in logs can reveal that an agentic identity executed an action on behalf of a human user and surface the true origin and scope of that activity.

Agent.agentType was set to agenticAppInstance and agentSubjectType to notAgentic the two fields that, together, indicate an assistive (OBO) flow rather than a classic service principal or autonomous agent sign-in.

This chain of evidence enables a minimum viable story: at 2026-05-08T15:27:05Z, Agent001 used Microsoft Graph (beta) to send mail as matt@ContosoCorp.onmicrosoft.com to bigwig_CFO@importantcompany.com, originating from IP 51.3.97.221 with user-agent “Mozilla/5.0 … PowerShell/7.6.1.”

Microsoft Entra Agent ID Logs

The recorded Microsoft Graph scopes show the delegated permissions granted to the agent blueprint principal when the user consented to the access_agent scope, and sign-in details indicate the token satisfied per-user MFA via a claim in the token.

Operational takeaways are clear and immediate. First, assistive agents can and will execute high-impact actions consistent with the intersection of agent-scoped permissions and the end-user’s assigned roles; blocked high-risk Graph permissions reduce but do not eliminate exposure.

Second, defenders must correlate across Purview/Exchange logs, MicrosoftGraphActivityLogs, and AADNonInteractiveUserSignInLogs to disambiguate agent activity from user or service principal activity.

Key correlation pivots include AppAccessContext.UniqueTokenId ↔ SignInActivityId, ClientRequestId ↔ ClientRequestId, and matching SessionId values.

Third, presence of agent.agentType == agenticAppInstance paired with agent.agentSubjectType == notAgentic is the reliable indicator of an assistive OBO flow, while agentSubjectType == agentIDuser or sign-in table differences indicate other agent scenarios described in the reference material.

Detection designers should instrument rules that flag unexpected Mail.Send Graph calls where the caller is an agent identity, where the originating IP differs from typical user locations, or where the scope set includes Mail.ReadWrite/Mail.Send.

Microsoft documentation on On behalf of flow and Agent ID (links in the original investigation) and Red Canary series on Entra Agent ID provide pragmatic guidance for interpreting these logs.

Hunt workflows should validate how the access_agent consent was granted (redirect URIs, consent dialogs, and possible localhost captures), review the agent blueprint principal, and inspect the federatedCredentialId and parentAppId fields to find the blueprint origin.

As agent adoption accelerates, defenders must treat assistive agents as first-class identity types: instrument logs, build correlation playbooks, and enforce least privilege and monitoring around agent blueprints and consent surfaces to prevent or rapidly remediate agent-facilitated abuse.

Follow us on Google News, LinkedIn, and X to Get Instant Updates and Set GBH as a Preferred Source in Google.