In this episode of Know Your Adversary, Jared Atkinson and Justin Kohler sit down with Hope Walker and Elad Shamir to discuss Microsoft’s emerging agent identity ecosystem and the security challenges that come with it. They break down how agents, identities, blueprints, flows, and supporting resources interact across Microsoft platforms, and why understanding those relationships is becoming increasingly important.
The group explores how agent identities can cross traditional boundaries, inherit access through different identities, and introduce new attack paths. Hope and Elad discuss their work modeling these relationships in BloodHound to move beyond simple agent inventories and visualize who can control an agent, what identities it can act as, and what resources it can ultimately reach.
They also look at the challenges of securing a rapidly changing technology, from citizen-developed agents and overprivileged identities to MCP servers and evolving Microsoft permissions. The takeaway is that agents don’t operate in isolation, and understanding their security impact requires connecting them to the broader Entra and Azure graph.
00;00;00;26 - 00;00;04;03
Speaker 1
He was really to.
00;00;04;05 - 00;00;06;11
Speaker 1
Go.
00;00;06;14 - 00;00;34;19
Justin Kohler
Welcome back to the Know Your Adversary podcast. My name is Justin Kohler. I'm Jared Atkinson, and today we're joined by Hope Walker and Elad Shamir. We're here to talk about Microsoft agents IDs or whatever it's called today to start us off. Would you mind explaining first why that is funny? Why? What's it called today? I guess give us a sense of what is agents in Microsoft Land, and then we'll talk about the how this incorporates into BloodHound or what we were trying to do.
00;00;34;20 - 00;00;35;08
Hope Walker
Yeah.
00;00;35;09 - 00;01;03;20
Hope Walker
So the infrastructure that Microsoft is setting up to support agents and agent activity in tenants is across several different platforms. So we have Copilot Studios that we have foundry, we have the entirety D tenant where the identities are residing. It's kind of sprinkled throughout a bunch of different areas, and it is integrating further into products as they add more features and capabilities.
00;01;03;20 - 00;01;12;19
Hope Walker
So even though it is starting there, it may reach out to Azure for resources. It may reach out to SharePoint for documentation, stuff like that.
00;01;12;20 - 00;01;28;00
Justin Kohler
So is a silly question I might have. Like I would I see as a user, would I see an agent identity in Azure Resource Manager like you say? And then also there's this other section in Microsoft Land where then it's trying to be centralized. Is that how I should think about this?
00;01;28;01 - 00;01;49;13
Hope Walker
Yeah. So they are trying to centralize it into the agent registry, where that is going to be the single source of looking up your agent identities, looking up what your agents have, the access or some access to it doesn't have complete visibility into everything that is configured on the agent, but it is a starting place.
00;01;49;14 - 00;02;02;02
Justin Kohler
Okay, so like I could probably get the basics and then I could dig into, let's say copilot, maybe if I have some copilot specific question. Right okay. Okay. So basically Microsoft is going to give you a list, but we need.
00;02;02;02 - 00;02;03;20
Elad Shamir
To start thinking about it in graph.
00;02;03;21 - 00;02;04;21
Justin Kohler
Yeah. Yes.
00;02;04;23 - 00;02;05;21
Elad Shamir
Have been both.
00;02;05;23 - 00;02;14;29
Justin Kohler
Thanks for that segue. So what. So we wanted to look into this for multiple different reasons. But like I guess what was the genesis of like where did you stop.
00;02;15;02 - 00;02;41;19
Hope Walker
Yeah. So we actually started at a hackathon in January where we were looking at copilot. We wanted to understand how it is communicating, and then we very quickly realized it is more complicated than we thought it was. Whatever we have these identities, it is not just an identity like a user identity that stands alone. There are supporting resources for that, such as blueprints that come in and are templates for the agents.
00;02;41;19 - 00;02;51;12
Hope Walker
And so we quickly realize that, wow, this is much bigger. And it's not just copilot, it's also these other platforms as well.
00;02;51;14 - 00;03;13;19
Justin Kohler
Do you? You mentioned blueprints and identities. You're obviously like trying we're trying to model this into BloodHound. Give us a sense for what you're thinking in terms of the node. Like the schema. Right? Like, so you have like an identity. A blueprint is what are the components? Yeah. And I know this is a like a changing ball because this is a preview right for Microsoft.
00;03;13;19 - 00;03;15;02
Justin Kohler
So they're changing things out from under you.
00;03;15;02 - 00;03;42;19
Hope Walker
But it is changing. So there are the agents themselves and the identities that we can come in and look at and identify okay. This has an identity which means it can access resources. And then there are the supporting components that we have to it blueprints, everything like that. These don't work in isolation. They are going to be hooked up to other resources as well.
00;03;42;19 - 00;04;04;06
Hope Walker
So we have MCP servers. We have flows that can be configured and added on there to where it is a workflow that you go through. It's a graphical editor, very easy for users to set up, and then that is configured with credentials as well to access those resources, because sometimes it's the agent identity, sometimes it's the maker identity.
00;04;04;06 - 00;04;07;10
Hope Walker
It could be a variety of different combinations.
00;04;07;11 - 00;04;13;19
Justin Kohler
For the maker identity. So that'd be like if I'm going to craft an agent, I'm the maker. It started to understand that that directly correct. Okay.
00;04;13;20 - 00;04;39;27
Hope Walker
So it is for a specific condition in there. Usually we're seeing this in like flows where you have an agent and it's like, all right, your purpose is to perform this task. So you create a flow and you're like normally whenever I am performing this task, I have to access this resource. So in order for my agent to access that resource for me and perform the task, I'm going to give it my credentials in this flow.
00;04;39;27 - 00;04;45;10
Hope Walker
And then it's able to access that information and perform the task of is designed for.
00;04;45;11 - 00;04;59;03
Justin Kohler
And sorry, I'm going to like I'm going to quickly get into a thousand questions feel like the the. So if I'm a maker and I create this agent it's on this flow like you mentioned. Can anybody else use that as well. And then is using my maker identity.
00;04;59;05 - 00;05;34;09
Hope Walker
That is a great question. So there is not a ton of support for silo and foundry and stuff like that. You can have more silos, but in these other platforms that doesn't necessarily exist. Okay. So it is possible for organizations to have especially organizations that have opened this up to their entire employee base to have cross department use of resources, without somebody really understanding what it is that they put into their agent and what sort of flows they're using in connections, they're using what access to resources they actually have.
00;05;34;10 - 00;06;01;28
Hope Walker
It's enabled a lot of what Microsoft calls citizen developers to create these workflows and agents and everything like that. They don't necessarily have the same security considerations. Yeah, they just want it to work. Right. And if one flow does not work for them, they'll move to the next one that they can see in the inventory. And then if that one doesn't work, next one until finally somebody, somebody maker credentials are going to work.
00;06;01;29 - 00;06;05;02
Hope Walker
Usually that's a very highly privileged maker.
00;06;05;04 - 00;06;12;26
Jared Atkinson
Yeah. You on the flows. So it sounds like somebody can create a flow and then make it available for others to adopt as part of their agent workflow.
00;06;12;29 - 00;06;16;06
Hope Walker
It's all supposed to be very easy. Yeah, right.
00;06;16;07 - 00;06;42;15
Justin Kohler
That's terrifying. So we were talking before this and it was like, well, one thing that we can show in BloodHound with this visibility while it's under preview and while it's changing constantly, is you mentioned like somebody in finance is using an engineering flow and that might be bad for reasons. Right? So I because that's not access. You wouldn't think of a person in finance having the same level of access as an engineer or vice versa.
00;06;42;16 - 00;06;48;15
Justin Kohler
Right. Exactly. And but like this is a way where you're like kind of crossing all of those boundaries. Okay.
00;06;48;16 - 00;07;21;11
Hope Walker
Yeah. And I from what I've gathered from organizations that opened this up, they are underwater trying to deal with this, trying to get some insight because these are not centralized very well because you can't see all of the resources. You can't see these different interactions between departments. You can't see where something is being reused. There could be a very popular template, a blueprint that somebody is using, the organization is using, and then somebody grants rights to an agent derived from that template.
00;07;21;12 - 00;07;27;20
Hope Walker
That template controls that agent. Somebody else is in control of that template.
00;07;27;22 - 00;07;30;08
Justin Kohler
Yeah. That's awesome.
00;07;30;11 - 00;07;49;01
Elad Shamir
So the few from the few conversations that we had with some organizations that are already using that, the impression that I've been getting is that by getting ahead of the problem, they're trying to sort of create an inventory, figure out what what have they got in the organization, who is using it, what agent subsists, and and so on.
00;07;49;01 - 00;08;16;16
Elad Shamir
And the problem is, again, is the point I made earlier that they're starting to make lists. But the problem is that it doesn't start from the agent. It doesn't end at agent. Many different security principles. Users can invoke the agent, and once the agent invoked, it is often acting as a different identity. In a maker, it can be other agent bodily, and those have of missions.
00;08;16;17 - 00;08;43;09
Elad Shamir
And while it's a bit tricky at this point to actually abuse that and make the agents to determine deterministically do what he wanted to do and maliciously, there's still potential for that. So it's important to show those identity transitions. Now extend that either then it's the agent's agent and act as a different identity. Other agent.
00;08;43;12 - 00;08;44;09
Elad Shamir
Airport flows.
00;08;44;09 - 00;09;00;13
Elad Shamir
And there are just potential for multiple identities, musicians and the assets purposes. The mechanism that needs to govern this is often aligned to those issues. Nobody knows what access to agents has.
00;09;00;15 - 00;09;18;19
Justin Kohler
Yeah, it's looking at it maybe from like the flow like like it sounds like from the designer perspective. Like that's the picture it has. And that's what people are trying to stitch together. And that's what we're ideally hoping to pull all into one graph. Right. Or BloodHound.
00;09;18;21 - 00;09;42;01
Hope Walker
Pulling it all together into one graph I think is very crucial right now, because we can end the portal and different admin applications that they're using to try to look at these. It's really only one step at a time. You know, you identify the blueprint principle. Then you have to go to another page to see the agents. Then you have to go to another page to see what roles, if any, they have assigned.
00;09;42;01 - 00;09;53;14
Hope Walker
And what we're trying to do is make it to where it's like, no, I want to see the impact starting here. How does it branch out? Who else is reaching in for these resources?
00;09;53;18 - 00;10;07;15
Justin Kohler
I'm just going to say that again, because that it's kind of weird that it's the case, but you're saying that there's a blueprint page, there's an identity page, there's a roll page, and those are all separate pages. Yeah. So like, I mean at a base case, like we could just visualize all of that in BloodHound.
00;10;07;22 - 00;10;08;14
Hope Walker
Exactly.
00;10;08;15 - 00;10;09;04
Hope Walker
Yeah.
00;10;09;05 - 00;10;32;14
Elad Shamir
And with blueprints it's more interesting, I think, because I use the term branch out single blueprint can actually control multiple agents. It's not a single agent. So once you control a blueprint it potentially control multiple hundred. Yeah. Yeah. And eight agents 88 entities with different. And it's very interesting.
00;10;32;17 - 00;10;48;11
Jared Atkinson
Hope you're very knowledgeable about kind of the permission structure. And azure and intra are blue like do you when Elad says control of a blueprint is that similar to the Rbac that you would see typically for other Azure resources, or is this something completely different?
00;10;48;11 - 00;11;15;22
Hope Walker
In a way, yes. So this is primarily done through owners. We have owners and sponsors. The sponsors don't have much of a administrative role or permissions, but the owners do. They have full control over whatever component it is that they have. So if that is a blueprint, that is the blueprint itself, what everything else is being derived from, as well as those things that are derived from the blueprint.
00;11;15;23 - 00;11;15;28
Justin Kohler
Like.
00;11;15;28 - 00;11;16;14
Justin Kohler
An agent.
00;11;16;20 - 00;11;30;05
Jared Atkinson
Exactly. Okay, okay. And there is it's pretty coarse grain right now as far as like owner gives you a kind of a bundle of permissions over the blueprint. But there's not the ability to like define. Justin can have, you know, right to this property or something like, like more specific.
00;11;30;06 - 00;11;42;14
Hope Walker
They do have inter roles to support agent identities. So there are that's another complication that comes in where somebody has administrative roles in enter assigned. What does that actually get them in foundry.
00;11;42;15 - 00;11;42;20
Jared Atkinson
I.
00;11;42;20 - 00;12;04;25
Hope Walker
Said you know because that's a that's a slightly different platform. There's a different set of permissions, a different structure that is set up. It is a pain because you have to go into each individual project and foundry and assign these permissions. So that is one way where they're starting to silo. But that's not how it exists in all platforms like Copilot studio.
00;12;04;26 - 00;12;22;09
Jared Atkinson
Sure, sure. And then can you, can you maybe talk during the course of this research you have like a working prototype and then Microsoft changed the whole thing out from under you. I mean, it seems like that's a constant that's also not like that. It is under a preview. Right. So we can't we can't necessarily be mad. But yeah, I mean you can't be mad.
00;12;22;12 - 00;12;40;01
Jared Atkinson
It might be more mad than yeah, that's good to be mad. But like in general Microsoft's upfront spring preview will change. What do you want. But it's it's like a challenge to kind of like understand all of this because as you start to get this like a grasp of how everything's working, something changes and it's not obvious that it changed and or how it changed and all that kind of stuff.
00;12;40;02 - 00;13;01;12
Hope Walker
It has. So it's changed pretty drastically. We are seeing some of the early issues that came up from research being addressed, as these features are coming out of preview, so Microsoft is trying to keep up with what is coming out and the tradecraft that is coming out, and go ahead and mitigate that before it's in general availability.
00;13;01;13 - 00;13;02;08
Justin Kohler
Yeah. Which is what you've.
00;13;02;08 - 00;13;03;01
Hope Walker
All exactly.
00;13;03;01 - 00;13;04;20
Justin Kohler
But it doesn't make your job less frustrating.
00;13;04;20 - 00;13;06;19
Hope Walker
It does not make my job less frustrating.
00;13;06;22 - 00;13;13;07
Jared Atkinson
Talk about frustrating. I think you had two tenants and they were on different versions. Yes. So it's Elad's story.
00;13;13;09 - 00;13;54;01
Hope Walker
We had. I spent a very long time getting a bunch of stuff set up in our first tenant, and then getting it to reflect and hit the right endpoints in in Bloodhound and then move to another tenant went through the same process, set everything up. The interfaces were different. There were features that were coming out of preview. So and it was I think one of the very difficult portions of it is we are using LMS to support some of this research, go and do those things that we would do, like, hey, look up those API endpoints, look up at the walk through and put it in the context for what I'm trying to do.
00;13;54;03 - 00;14;13;11
Hope Walker
But the information is so new the LMS can't get to it. They don't know about it. They are having like we are accelerating and keeping pace with the LMS, but it is still a very difficult task to account for all of the differences as these things are developing on the Microsoft side.
00;14;13;14 - 00;14;32;03
Justin Kohler
So if you're a proposed user, if your company is asking you how will I secure these agents like that's it's already seems like an impossible task and you're kind of backing it up because everything's changing out from under them. It's like how it's organized, how it's managed. It's I mean, if anybody's frustrated right now with like, how would I get my hands around the problem?
00;14;32;03 - 00;14;33;26
Justin Kohler
It sounds like for a good reason.
00;14;33;26 - 00;14;57;27
Hope Walker
It is a good reason. But I think that a lot of security people are coming into it with a lot of lessons learned already. We know that there needs to be the separation. We know what permissions look like and what is dangerous. So even though there's not a ton of tradecraft right now, we know what is going to be a problem in the future because we've seen it be a problem in other platforms.
00;14;57;29 - 00;15;00;04
Justin Kohler
Right?
00;15;00;07 - 00;15;25;24
Elad Shamir
Typically, when we introduce abuse primitives into BloodHound, it's not it's it's not the things that might go to go in service. It's abusing intended. So now Hope's next project is discovering those intended functionalities that can be abused and take. Over all the different components come along. These agents.
00;15;25;29 - 00;15;39;10
Justin Kohler
And you mentioned MCP servers. I think I saw some of the screenshots from earlier work so we could see like, I mean, some might seem basic to you, but it's super cool. When I first saw it was like, you connect through here and here's all the MCP servers you could address without it. Yeah, true.
00;15;39;13 - 00;16;04;10
Hope Walker
That is true. So we can see the MCP servers and different resources like that. I will go ahead and say that's already changed on the South side of course. So the relationships are constantly changing. It is for the better. You know, I would much rather Microsoft do right by all of this technology rather than have something cool to show.
00;16;04;11 - 00;16;05;09
Justin Kohler
Yeah, yeah.
00;16;05;10 - 00;16;08;00
Hope Walker
Because that's going to shake out either way. Yeah.
00;16;08;03 - 00;16;28;03
Elad Shamir
Also when it comes. Sorry, you can't stand up MCP servers. I have to I have to make one comment. Of course, I can't go through a podcast without mentioning the key source principle. So of course, if you hook up your agent with an MCP server and that MCP server is not trustworthy enough, it can affect what your agent is doing.
00;16;28;05 - 00;16;33;11
Elad Shamir
If your agent is acting as sub privilege and identity, you're opening it.
00;16;33;11 - 00;16;33;15
Justin Kohler
Up.
00;16;33;15 - 00;16;45;10
Elad Shamir
For a world of pain. So make sure that you don't bring in any MCP servers that are less trustworthy than the identity they are. Agent is going to act is.
00;16;45;11 - 00;17;00;14
Jared Atkinson
I think, one of the general ideas that caused us to be interested in kind of like agents in general, and how they affect the attack path is there's this there's this problem where a human user can have more privilege than they need to do their job. But like the typical windows user doesn't know what a domain controller is.
00;17;00;14 - 00;17;18;24
Jared Atkinson
So even if they had admin on a domain controller, they may never discover that, right? Because they're not trying to find the domain controller and log in. But an agent is going to basically use whatever it has access to to accomplish whatever his job is. And so if you over permission a, a, an agent, then they're going to be able to discover that and and use it.
00;17;18;24 - 00;17;28;17
Jared Atkinson
And you mentioned like non-deterministic right. So you may ask similar questions over and over and get different results as a, as kind of a outcome that becomes a problem obviously.
00;17;28;19 - 00;17;30;12
Hope Walker
Actually. Yeah.
00;17;30;14 - 00;17;53;28
Justin Kohler
So we just announced this in beta in while this is changing, we're still able to show a lot. We're still able to visualize a lot of relationships. Where do you think obviously you can't figure out where this is going to stop and where it's going to be, like early access to general available on the Microsoft side, but do you have a picture of what this actually looks like when it's all said and done?
00;17;54;03 - 00;18;11;00
Justin Kohler
Is it like the visualizing the relationships and then developing the tradecraft and saying, okay, I can traverse from like if I got access to Hope's account, I could get access to what she can access, but I can also access all of her agents. And if those agents have access over a Elad account, then now I have access over to Elad's account.
00;18;11;01 - 00;18;13;02
Justin Kohler
Is that how we should be thinking about this?
00;18;13;03 - 00;18;42;24
Hope Walker
So as far as continuing further, I'm coming in with a entirely open mind. I think there is a lot of capability, not just through the relationships, but also through that non-deterministic behavior of the agents where we can go in and it's like, all right, this is the type of attack that I think would work. But really getting in there and just seeing what the agent is willing to do, especially whenever we have agents that are being stood up by these citizen developers.
00;18;42;24 - 00;19;09;00
Hope Walker
They don't have guardrails, they don't have skills, they don't have any sort of thing that is locking down and keeping the agent from doing things that it should not do. So I think whatever we get into that tradecraft, discovery, whatever we are looking at, that if we go in thinking that it is just going to be this straightforward like it is on, on prem Active Directory, it's going to be so much wilder than that.
00;19;09;02 - 00;19;26;29
Jared Atkinson
Fun. Maybe one of the. So just to mention this beta that we're trying to roll out, one of the things that you and I have talked about is for customers that are already collecting Azure. I don't know if this has changed, so maybe maybe it has. But previously there was an ability to kind of discern that you have agents based on kind of like service principles that you've already collected.
00;19;26;29 - 00;19;32;26
Justin Kohler
And the typical like Azure BloodHound graph. Is that still a thing or has it changed?
00;19;32;28 - 00;19;53;24
Hope Walker
So a lot of the agents are going to be service principles as well. They have that as their identity. And so we can start to see that there is a difference. This is a new type of service principle that Microsoft is introducing. And so it is kind of separate from that. But we've already dealt with application service principles.
00;19;54;01 - 00;20;01;08
Hope Walker
We kind of know what that looks like and how to gather information and start modeling those types of identities.
00;20;01;09 - 00;20;10;10
Justin Kohler
If I if we collected Azure today and we saw as service principles, would would the agents be a subset of the service principles we already collect or would be a completely new class.
00;20;10;12 - 00;20;37;10
Hope Walker
So it is a new class of service principles? Okay, I will honestly say I don't know if the current collectors for Azure are are finding that, but we are seeing it populate as A-Z app right now. Okay, so there is crossover between those. And I know with the combination of the two we can definitely determine like hey, this is definitively an agent identity.
00;20;37;13 - 00;20;38;26
Elad Shamir
That's nice.
00;20;38;28 - 00;21;01;21
Jared Atkinson
I yeah, I think maybe, maybe the question I'm getting at is there may be opportunities if let's say you're somebody that uses BloodHound and you don't know whether your company has opted into this agent ecosystem, I guess there may be opportunities for you to ask questions about your Azure Graph that would say, not definitively to your point, but there may be something more to kind of like uncover here, and maybe you should give it a try to see kind of what it actually looks.
00;21;01;22 - 00;21;02;20
Hope Walker
Absolutely.
00;21;02;21 - 00;21;14;17
Justin Kohler
When you when you're enumerating whatever APIs are changing, are you asking for different roles or different permissions, like is that a special permission to read the agent area of.
00;21;14;18 - 00;21;35;12
Hope Walker
Yes. So depending on the platform that you're doing, there are several different permissions that you can have set up and everything like that. Right now, we're targeting least privilege because we want to go into this cautiously and make sure that we are doing it. We do have support for enriching it with that, those admin privileges. But yes, there's a lot of permissions to set up.
00;21;35;12 - 00;21;42;08
Hope Walker
Luckily, we've automated a lot of that already for that setup, and it makes it easier to deploy in these new environments.
00;21;42;09 - 00;21;46;24
Elad Shamir
Yes. Does it require a license as well?
00;21;46;26 - 00;21;49;29
Hope Walker
It does require license. So everything is licensed.
00;21;50;01 - 00;21;55;05
Justin Kohler
So ask your finance guy if you're using it. If you're not sure. Still.
00;21;55;08 - 00;22;04;15
Jared Atkinson
Cool Elad. Hope. Do you have any final ideas or thoughts that you want to make sure that our listeners hear about this?
00;22;04;18 - 00;22;33;01
Elad Shamir
One thought is that, as Hope mentioned, agents don't run in isolation, so it's important to connect all the agent components to the rest of the Entra and Azure graph to see what can control the agents and what the agents can control. And then you can unravel a very interesting story in some cases. And so it's not just to have to go beyond the inventory, the whole story.
00;22;33;03 - 00;22;55;22
Jared Atkinson
Yeah. And maybe that brings up a different question that I think is somewhat obvious, but maybe is worth clarifying as as this progresses through like beta and it becomes kind of better conceptualized, it will be part of a typical like Azure. It's part of the Azure ecosystem. So you should think of it as an additional component of the Azure or Entra graph, as opposed to something that sits on its side.
00;22;55;23 - 00;23;00;12
Justin Kohler
Yeah, yeah. Okay. Hope final words.
00;23;00;15 - 00;23;01;24
Hope Walker
Nothing I got. All right.
00;23;01;25 - 00;23;10;21
Jared Atkinson
Well thank you both for joining us. And thank you everybody for listening. And we'll see you next time. Thank you. Cool. You say that's cool. Yeah.