Microsoft patched a privilege escalation flaw in a built-in Entra ID role called Agent ID Administrator, introduced to manage AI agent identities, that allowed an attacker with access to the role to seize control of service principals beyond its intended boundary. According to security researchers, the role’s permissions were not properly scoped, creating a lateral movement path inside Entra ID tenants. The finding signals a broader governance risk: AI agent frameworks are generating new identity objects and roles that most organizations’ access control review processes were not designed to evaluate.