Entra ID Flaw Could Hijack Any Company’s Tenant

Microsoft recently patched a serious Entra ID flaw that allowed attackers to hijack any organization’s Azure/Entra ID tenant. The flaw emerged from a mix of legacy actor tokens and a vulnerability in the Azure AD Graph API. It risked full tenant takeover without detection.

What the Flaw Entailed

Security researcher Dirk-jan Mollema discovered that “actor tokens,” undocumented legacy tokens issued by the Access Control Service, let attackers impersonate users inside any tenant. These tokens lacked proper signatures. They bypassed user validation and could be used even if you didn’t belong to the target tenant. The flaw (CVE-2025-55241) also allowed unsigned tokens to work via Graph API, giving Global Admin privileges.

How Attackers Might Exploit It

An attacker could start from a tenant they control, then use actor tokens and a known tenant ID and user netId to craft impersonation. Using the vulnerable API, they could modify users, reset passwords, or gain admin roles in another organization’s tenant. The worst part: these actions left no logs in the victim tenant, except for what happened through that external service.

Scope and Risk

Many organizations rely on Entra ID (formerly Azure AD) for identity access, single sign-on, and MFA across apps. This flaw put them at risk of data theft, configuration changes, or further infiltration. Because tenant IDs and some user IDs are often discoverable, exposure could be widespread.

What Microsoft Did

Microsoft acknowledged the issue and confirmed fixing CVE-2025-55241. They also started deprecating Azure AD Graph API and began removing actor token support in legacy services. The patch came nine days after reporting. They urged customers to verify they aren’t using outdated components and to restrict access where possible.

What Companies Should Do

Admins should:

• Confirm that their tenant no longer accepts actor tokens and that Azure AD Graph API is disabled.
• Check tenant configurations for legacy services that depend on actor tokens.
• Audit access logs for unusual activity, especially from external services.
• Ensure conditional access policies enforce least privilege.

Conclusion

This Entra ID flaw highlighted a weakness in Microsoft’s identity stack that could let attackers hijack tenants with little to no trace. Microsoft’s fix helps, but firms must verify their environments and eliminate reliance on legacy services. Acting fast prevents serious risk to data, operations, and security posture.