🔐 Hackers Can Abuse Entra Agent ID Admin Role to Hijack Service Principals
Source: https://t.co/ePEtkkkXAl
A critical scope overreach vulnerability was recently identified in the Microsoft Entra Agent Identity Platform. The newly introduced Agent ID Administrator role allowed accounts to hijack arbitrary service principals and escalate privileges across the entire tenant.
New research found that actions like updating agent identity owners allowed administrators to modify the ownership of any service principal in the tenant.
A user with the Agent ID Administrator role could assign themselves as the owner of a completely unrelated, high-privileged service principal.
#cybersecuritynews
🚨 CYBERATTACK ALERT IN PROGRESS: MASSIVE DENIAL OF SERVICE (DDoS) – EBAY 🌐⚔️🔥
A coordinated offensive has been detected against the global infrastructure of eBay, one of the giants of e-commerce. The hacktivist group 313 Team (Islamic Cyber Resistance in Iraq) has claimed responsibility for a Distributed Denial of Service (DDoS) attack that has rendered critical platform services inoperable.
🏢 Victim Entity: eBay Inc. (https://t.co/vFnNJBF4GH).
👤 Threat Actor: 313 Team (Islamic Cyber Resistance in Iraq).
📂 Attack Type: DDoS (Distributed Denial of Service).
📅 Date and Time: April 26, 2026.
⚠️ Status: ACTIVE. The group indicates that the attack is scheduled to last at least 4 hours.
📊 Scope of Disruption
The attack has directly impacted the platform's availability, causing upstream connection errors:
Affected Functionalities:
Search: The main search engine displays "page down" errors.
Login: The https://t.co/je2vthadjm subdomain is experiencing saturation/header reset errors (reset reason: overflow).
Evidence of Outage: Reports from https://t.co/ztgVhf2tnE have been provided, confirming the global inaccessibility of key subdomains.
#CyberSecurity #eBay #DDoS #313Team #CyberResistance #Hactivism #BeamedSU #VECERT #InfoSec #CyberAttack ⚔️🛡️⚠️🚨🌐
MICROSOFT OPEN-SOURCED THEIR ENTIRE SENTINEL SECURITY TOOLKIT
most teams building on azure figure out threat detection the hard way
trial and error, custom KQL, dashboards built from nothing, playbooks written by hand
nobody told them it was already done
the sentinel github repo has:
▫️ 1000+ pre-built threat detection rules
▫️ hunting queries for active threat investigation
▫️ automated response playbooks
▫️ security workbooks + dashboards
▫️ data connectors for 100s of sources
the hard part was already done
https://t.co/VHbH2pIRRe
Zero Trust Explorer (by Merill Fernando): interactive map of M365/Azure security controls across identity, devices, apps, and data.
Great way to see how Entra ID, Defender, Intune, and Purview fit together in real architectures.
https://t.co/R8j1tj3fZB
#ZeroTrust
It appears that Microsoft removed the discovery of all domains in a tenant through ACS, a technique that I shared at my BH/DC talks last summer (though probably not many people spotted the reference). I found it out during a live demo of course 🙃
Microsoft baseline security mode for Office, SharePoint, Exchange, Teams, and Entra is now fully rolled out to all tenants!
Baseline Security Mode is a centralized experience that helps you meet Microsoft's recommended security standards across Office, SharePoint, Exchange, Teams, and Entra.
It leverages Microsoft's threat intelligence and insights from two decades of Microsoft Response Center cases to strengthen your organization's security posture and prepare for evolving AI-driven threats.
𝐖𝐡𝐞𝐧 𝐭𝐡𝐢𝐬 𝐰𝐢𝐥𝐥 𝐡𝐚𝐩𝐩𝐞𝐧:
- Public Preview: Rollout begins mid-November 2025 and completes by late January 2026.
- General Availability (Worldwide): Rollout begins mid-November 2025 and completes by late January 2026.
- General Availability (GCC): Rollout begins early January 2026 and completes by late January 2026.
- General Availability (DoD): Rollout begins early February 2026 and completes by late February 2026.
- General Availability (GCCH): Rollout begins early March 2026 and completes by late March 2026.
𝐇𝐨𝐰 𝐭𝐡𝐢𝐬 𝐚𝐟𝐟𝐞𝐜𝐭𝐬 𝐲𝐨𝐮𝐫 𝐨𝐫𝐠𝐚𝐧𝐢𝐳𝐚𝐭𝐢𝐨𝐧:
Global admins and security admins managing Microsoft 365 tenants across Office, SharePoint, Exchange, Teams, and Entra.
𝐖𝐡𝐚𝐭 𝐰𝐢𝐥𝐥 𝐡𝐚𝐩𝐩𝐞𝐧:
- A new Baseline Security Mode dashboard will be available in the Microsoft 365 admin center.
- Admins can view the tenant's current security posture compared to Microsoft's recommended minimum security bar.
- Admins can run impact analysis reports to assess changes before applying them.
- Recommendations will be grouped by risk level, with statuses such as "At risk" or "Meets standards."
- No immediate user impact unless admins apply changes.
𝐖𝐡𝐚𝐭 𝐲𝐨𝐮 𝐜𝐚𝐧 𝐝𝐨 𝐭𝐨 𝐩𝐫𝐞𝐩𝐚𝐫𝐞:
1. Navigate to Microsoft 365 admin center > Settings > Org Settings > Security & privacy > Baseline Security Mode.
2. Review recommendations marked as "At risk."
3. Initiate an impact report to understand potential changes.
4. Apply recommendations to bring your tenant to "Meets standards."
Communicate upcoming changes to your helpdesk or security teams.
#Microsoft365 #ExchangeOnline #EntraID #SharePoint #Teams #Cybersecurity
We're investigating a potential issue impacting multiple Microsoft 365 services, including Outlook, Microsoft Defender and Microsoft Purview. Further information can be found in the admin center under MO1221364.
The #Azure Updates Team announce, Availability Zones and network restricted #AzureKeyVault and App Configuration references for Flex Consumption (GA) from The Azure Updates Team https://t.co/aDi5tbRlzd