A significant combination of heritage components can have a complete access to the Microsoft Entra ID tenant of every company in the world.
The malignant mixture included a wanderer called “actor tokens” and a vulgarity in the AD Graf API (CVE-2025-55241), which allowed the tokens to work with any organization’s entra ID environment.
A threat -threatening actor, who exploited the issue, would have access to a sleeve of highly sensitive data without leaving any marks in the log in the target environment.
Entra ID is the cloud-based identity and access management (IAM) service of Microsoft, which is first known as Azure Active Directory (Azure Ad), which provides universities with single sign-on, multi-factor authentication and safety control in applications and resources.
A dedicated Entra ID example represents a single outfit and manages safe access to all apps used, both on-rude and cloud-based.
This may include Microsoft 365 services, customs and third-party SAAS products such as salesforce, dropbox, or google, amazon or sap to cloud apps.
Security researcher Dirk-Jan Molema, founder of aggressive security External securityDiscovered a token verification defect, which gave him global administrator privileges in every entra ID tenant.
This level of access allows a full tenant to compromise and opens the door for any service certified through the Entra ID.
Implementing any user to a tenant
In a technical blog post, Molema states that actor token is issued by a heritage service called Access Control Service, which is used for authentication with Sharepoint applications and is also used internally by Microsoft. “
The researcher found them while examining the hybrid exchange setup. He noticed that the exchange would request him when communicating with other services on behalf of the user.
“The actor token allows it to ‘act’ as another user in the tenant while talking to the exchange, Sharepoint and as it turns out to Azure Ad Graph” – Dirk-jan molema
Actor tokens are not signed, meaning that they can be used to apply any user in the tenant, and there is a 24 -hour validity without the possibility of cancellation of during this period.
Molema says that “this whole actor token design is something that should never exist,” because they lack the proper necessary safety controls:
- There are no logs when actor token is released
- Since these services can prepare an unknown repatriation token without talking to Antra ID, there is no log when they are made or used.
- They cannot be canceled within their 24 -hour validity
- They bypass any restrictive ban on completely conditional access.
- We have to rely on logging from the resource provider to know that these tokens were used in the tenant.
The researcher says that the Microsoft service-to-service communication depends internally on the actor token and the company plans to remove them.
Microsoft calls them “High-liencile access (HPA)“This allows an application or service,” to copy other users without providing any evidence of the user reference.
When testing several methods to use an actor token, Molema replaced the tenant ID separate from the token tokens, and sent it to the post -based azure advertising graph API (((Graph.windows.net), Expecting the message “Access refusal”.
Instead, the error that the researcher saw, indicated that the token was valid, but the access was unauthorized because the user was not identified in the tenant.
Source: Dirk-jan molema
Mollema tried again, this time with a valid user ID from the target tenant, and returned the data requested to Azure Ad Graph API.
“I tested it in some more test tenants, which I had access to, to make sure I was not crazy, but I could actually use data in other tenants, as long as I knew his tenant ID (which is public information) and a user’s nattid in that tenant.”
Using the same actor token, the researcher was able to apply Global administrator Do all the tasks in the target tenant and the role (such as manage and create users of different roles, modify the configuration, reset the password, add the admin).
Mollema has highlighted that any action required to obtain a global administrator privilege has not generated any log in the suffering tenant.
From the point of view of an attacker, exploiting issues must have been possible in some stages, starting with a tenant to generate actor tokens under his control:
- Finding tenant ID for the targeted environment can be done with public API based on the name domain
- Target Targe
- Crafts a copy token with an actor token from the attacking tenant using tenant ID and Netid User in the afflicted tenant
- List the tenant and all their global appreciation Netid
- Craft a copy of a copy token for a global administrator
- Azure ad graph display any reed/right action through API
Molema noted that in the final phase only the activity would be recorded in the tenant suffering.
It is important to note that Microsoft launched the exception process for Azure Ad Graph API service in September last year.
In late June, the company warned that the apps were configured for Extended access But the Azure Ad graph was still used which will no longer be able to use API from the beginning of September 2025.
Molema reported issues to Microsoft on 14 July and the company confirmed that the problem was resolved nine days later.
On September 4, Microsoft also Patch cve-2025-55241To describe it as a significant privilege increase in Azure Entra.
The passwords broke in 46% of the atmosphere, almost doubled by 25% last year.
Picus Blue Report 2025 Now get a wider look at more conclusions on prevention, detection and data exfIs.
