Microsoft Entra Agent-IDs decken verdächtige Aktivitäten assistiver Agenten auf

A new investigation reveals how Microsoft Entra Agent ID logs capture suspicious behavior tied to what are called assistive agents, also known as interactive agents. These agents operate through a delegated access flow, meaning they carry out actions using a real user’s permissions rather than their own standalone credentials.

Assistive agents are designed to help users through a chat interface. That might include reading email, pulling calendar data, or answering support questions with minimal human input.

The problem is that, under the wrong circumstances, these agents can be manipulated or compromised and then used to carry out harmful actions while appearing to act as a trusted employee. Researchers at Red Canary identified this behavior and published a detailed report on how such an attack unfolds inside a real Microsoft 365 environment.

According to Red Canary report shared with