Critical Microsoft Entra ID Vulnerability Allowed Tenant Hijacking: CVE-2025-55241 (CVSS N/A)

Estimated reading time: 7 minutes

Key Takeaways:

  • A critical vulnerability in Microsoft Entra ID (CVE-2025-55241) could have allowed complete tenant hijacking.
  • The vulnerability stemmed from legacy components, including undocumented “actor tokens” and a flaw in the deprecated Azure AD Graph API.
  • Successful exploitation granted access to sensitive data without significant logging in the target environment.
  • Microsoft resolved the vulnerability and released a patch on September 4, 2025.
  • Organizations should update systems, review legacy authentication methods, and implement continuous monitoring to mitigate similar risks.

Table of Contents:

Understanding the Entra ID Vulnerability

Entra ID serves as Microsoft’s cloud-based identity and access management (IAM) service. It provides organizations with single sign-on, multi-factor authentication, and security controls across various applications and resources. Each Entra ID instance represents a single organization, managing secure access to both on-premises and cloud-based applications, including Microsoft 365 services, third-party SaaS products, and cloud apps from other providers like Google, Amazon, or SAP.

The vulnerability, discovered by Dirk-jan Mollema of Outsider Security, allowed an attacker to obtain Global Admin privileges in any Entra ID tenant. This level of access would enable full tenant compromise, impacting any service authenticated through Entra ID.

The Role of Actor Tokens and Azure AD Graph API

Mollema’s research revealed that “actor tokens,” issued by a legacy service called Access Control Service (ACS), were central to the vulnerability. ACS is used for authentication with SharePoint applications and is utilized internally by Microsoft. These actor tokens enable a service to “act” as another user within the tenant when communicating with Exchange Online, SharePoint, and the Azure AD Graph API.

Crucially, actor tokens are not signed, meaning they can be used to impersonate any user in the tenant. They also have a 24-hour validity period during which they cannot be revoked. Mollema emphasized the flawed design of actor tokens due to the absence of necessary security controls. Key issues include:

  • Lack of Logging: No logs are generated when actor tokens are issued.
  • Bypass of Entra ID: Token creation and usage do not involve Entra ID, resulting in no logs.
  • Irrevocability: Tokens cannot be revoked during their 24-hour validity.
  • Conditional Access Bypass: Any restrictions configured in Conditional Access are ignored.
  • Reliance on Resource Provider Logging: Detection depends solely on logging from the resource provider.

Microsoft uses actor tokens internally for service-to-service communication and is planning to phase them out, referring to them as “high-privileged access (HPA)” mechanisms that allow applications to impersonate users without proof of context.

While testing actor token usage, Mollema discovered that the deprecated Azure AD Graph API (graph.windows.net) accepted actor tokens issued for a different tenant. Instead of returning an “access denied” error, the API indicated that the token was valid but that the user’s identity was not found in the tenant. By using a valid user ID from the target tenant, Mollema successfully retrieved data from the Azure AD Graph API.

Visual depiction of Entra ID tenant breach with admin access

This allowed the researcher to impersonate the Global Administrator in the target tenant and perform actions associated with that role, such as managing users, modifying configurations, resetting passwords, and adding new administrators. None of the actions required to obtain Global Admin privileges generated logs in the victim tenant.

Attack Scenario

An attacker could exploit this vulnerability through the following steps:

  1. Generate Actor Token: Obtain an actor token from a tenant they control.
  2. Identify Target Tenant: Determine the tenant ID of the targeted environment using public APIs based on the domain name.
  3. Find Valid User ID: Discover a valid netId of a regular user in the target tenant.
  4. Craft Impersonation Token: Create an impersonation token using the actor token from the attacker’s tenant, combined with the tenant ID and netId of the user in the victim tenant.
  5. List Global Admins: Identify all Global Admins in the tenant and their netIds.
  6. Craft Admin Impersonation Token: Forge an impersonation token for the Global Admin.
  7. Perform Actions: Execute read/write actions through the Azure AD Graph API.

It’s important to note that only the activity in the final step would be logged in the victim tenant, making detection challenging.

Remediation

Mollema reported these issues to Microsoft on July 14, 2025, and the company resolved them nine days later. Microsoft also released a patch for CVE-2025-55241 on September 4, 2025, classifying it as a critical privilege escalation vulnerability in Azure Entra.

Practical Takeaways

  • For Technical Readers:
    • Ensure all systems and applications are updated with the latest security patches, including those for Microsoft Entra ID and related components.
    • Review and audit the use of legacy authentication methods and services, such as Access Control Service (ACS), and prioritize their migration to more secure alternatives.
    • Implement continuous monitoring and logging of all activities within the Entra ID environment, focusing on unusual or unauthorized access attempts.
    • Leverage real-time ransomware intelligence to anticipate and defend against potential threats exploiting identity vulnerabilities.
  • For Business Leaders:
    • Understand the importance of identity and access management (IAM) in securing your organization’s cloud resources.
    • Ensure your IT and security teams have the resources and expertise to manage and monitor your Entra ID environment effectively.
    • Prioritize the adoption of modern authentication methods, such as multi-factor authentication (MFA) and passwordless authentication, to reduce the risk of credential compromise.
    • Implement a supply-chain risk monitoring program to assess and mitigate the security risks associated with third-party vendors and service providers.

How PurpleOps Can Help

This vulnerability underscores the critical need for comprehensive cybersecurity measures. PurpleOps offers a range of services that can help organizations protect their Microsoft Entra ID environments and mitigate the risks of similar attacks, including:

  • Cyber Threat Intelligence Platform: Gain proactive insights into emerging threats targeting cloud environments and identity infrastructure.
  • Dark Web Monitoring Service: Detect compromised credentials and other sensitive information that could be used to exploit Entra ID vulnerabilities.
  • Breach Detection: Identify and respond to unauthorized access attempts and other suspicious activities within your Entra ID environment.
  • Supply-Chain Risk Monitoring: Assess the security posture of your third-party vendors and service providers to identify and mitigate potential risks to your Entra ID environment.
  • Telegram Threat Monitoring: Monitor Telegram channels and other online platforms for discussions and activities related to Entra ID vulnerabilities and exploits.

By leveraging these services, organizations can improve their security posture, reduce their risk of compromise, and protect their valuable cloud resources.

To learn more about how PurpleOps can help you secure your Microsoft Entra ID environment and protect against similar threats, explore our platform or contact us for more information at services. We also provide specific services like dark web monitoring, cyber threat intelligence, and supply chain information security that can aid in comprehensive protection.

FAQ

Q: What is CVE-2025-55241?

A: CVE-2025-55241 is a critical vulnerability in Microsoft Entra ID that could have allowed attackers to gain control over an organization’s Entra ID tenant.

Q: What are actor tokens?

A: Actor tokens are issued by a legacy service called Access Control Service (ACS) and enable a service to “act” as another user within the tenant.

Q: How was the vulnerability remediated?

A: Microsoft resolved the vulnerability and released a patch on September 4, 2025.