New Entra and Microsoft 365 detections expose hidden identity paths

At a glance

What this is: NHI Mgmt Group's analysis, drawing on Cayosoft's announcement: New detections flag accountable ownership gaps in Microsoft Entra agent identities, anonymous SharePoint access, unauthenticated Exchange relay, and weak BitLocker policy on domain controllers.

Why it matters: IAM, IGA, PAM, and Microsoft 365 teams need to treat identity accountability and trust configuration as live controls, because exposed access paths often begin with governance drift rather than exploitation.

Context

Microsoft identity programmes usually fail in the gaps between ownership, access policy, and service configuration, not at the point of authentication itself. When an agent identity has no active sponsor or owner, or when collaboration and mail controls are left in permissive states, the organisation loses the ability to explain who should be accountable for the resulting access path.

Cayosoft's September and October 2026 detections focus on four distinct governance failures across Entra, SharePoint, Exchange, and Active Directory. The common thread is not a single exploit technique but a set of identity control states that widen attack paths, reduce attribution, and make remediation slower after drift appears.

Treat Active Directory and Entra ID hardening as the baseline for understanding why these detections matter: the problem is not only whether a control exists, but whether its setting still constrains the path an attacker would actually use.

Key questions

Q: How do teams govern Microsoft Entra agent identities without active ownership?

A: Teams govern Microsoft Entra agent identities by assigning a named business owner, a technical sponsor, and a documented access policy for every agent registration. The live owner and sponsor must cover lifecycle actions such as approval, secret or certificate rotation, scoped consent, logging, and revocation when the agent no longer has a valid purpose.

Q: Why do anonymous SharePoint links and unauthenticated relay create identity risk?

A: Anonymous SharePoint links remove authentication from the access check, so anyone with the link can cross the trust boundary into the document or site if the link is shared or guessed. Unauthenticated relay is different, because it forwards traffic or messages without proving the sender’s identity, which can bypass controls that depend on authenticated users or trusted senders.

Q: How can weak domain controller encryption expose Active Directory credentials?

A: Weak domain controller encryption can expose password hashes by making it easier to read or recover credential material from memory, backups, replication traffic, or stolen disks. Once hashes are exposed, attackers may crack them offline or reuse them for pass-the-hash style access if account protections and privilege boundaries are weak.

Q: What is the difference between authenticated relay and anonymous email relay?

A: Authenticated relay forwards email or other messages only after the sender proves identity, usually with a mail account, relay permit, or authenticated session. Anonymous email relay accepts and forwards mail without sender authentication, which makes abuse, spoofing, and open relay behaviour much easier to exploit, especially where filtering trusts the relay path.

Technical breakdown

How inactive ownership weakens Entra agent identity governance

An Entra agent identity is a non-human identity that can carry permissions, operate continuously, and change state faster than manual review cycles often observe. The governance problem appears when the assigned owner or sponsor cannot act because the account is disabled or absent. In that state, the identity can keep its original access while no accountable human is positioned to validate purpose, permissions, or behaviour. That creates an identity lifecycle gap rather than a simple permissions issue. The control failure is not only missing documentation. It is the absence of a living accountability chain that can respond when the identity drifts or becomes unnecessary. See the Microsoft Entra Agent ID Guide.

Practical implication: Map every agent identity to an active owner and sponsor pair, then retire identities whose accountability chain is broken.

Why anonymous sharing and unauthenticated relay create trust bypasses

Anonymous SharePoint links and unauthenticated Exchange relay both weaken the normal identity assertion step. In the first case, the recipient is no longer bound to a signed-in identity, so access can be shared and used without durable attribution. In the second, a connector can accept mail without the sender being authenticated or tightly restricted, letting external systems pass messages through a trusted tenant boundary. These are different mechanisms, but both replace identity-backed control with transport convenience. Once that happens, logging and revocation become less precise because the system can no longer cleanly tie access to a specific accountable principal. See the SharePoint and OneDrive Security Guide.

Practical implication: Treat anonymous collaboration links and relay connectors as identity trust boundaries, not convenience settings.

How weak BitLocker policy turns a domain controller into an offline credential source

Domain controller encryption matters because the most sensitive identity material is not only live in memory. NTDS.dit, SYSTEM hives, and related artefacts can be copied from a shutdown server, virtual disk, backup, or snapshot and examined offline if drive protection is absent or weak. That changes the attacker model from interactive compromise to offline extraction, where the defender's monitoring stack may never see the abuse. The risk is amplified because domain credentials, including high-value accounts such as krbtgt, can be recovered from the stored data if encryption is insufficient or poorly protected. This is an access-path problem as much as a data-protection problem.

Practical implication: Verify that domain controller storage is encrypted strongly enough to resist offline extraction from disks, backups, and snapshots.

Threat narrative

Attacker objective: The attacker aims to turn legitimate identity and trust controls into durable access paths that enable spoofed communication, credential extraction, and broader privilege expansion.

1. Entry occurs through permissive Microsoft 365 trust settings, such as anonymous SharePoint links or an Exchange connector that accepts unauthenticated relay.
2. Credential access or abuse follows when the attacker uses the permitted path to operate as trusted traffic, or when offline access to a domain controller exposes stored credential material.
3. Escalation happens when compromised identity state or recovered hashes are used to expand privileges, move into additional systems, or maintain persistence without immediate detection.
4. Impact is the loss of confidentiality, integrity, and attribution across Microsoft 365 and Active Directory, including deceptive email delivery and broader domain compromise.

Breaches seen in the wild

• Microsoft Storm-0558 key breach 2023: China-based Storm-0558 used a stolen, never-retired Microsoft signing key to forge tokens and read email at 22 organisations in 2023.
• Cisco Active Directory credentials leak 2025: Kraken leaked Cisco Active Directory hashes, including service and krbtgt accounts; Cisco says they came from its 2022 breach, not a new one.

Read and download The State of NHI & AI Agent Breach Report 2026, covering 200+ breaches impacting Non-Human Identities including AI Agents.

NHI Mgmt Group analysis

Identity accountability is the control that keeps agent identities governable. Cayosoft's detections show that an Entra agent identity without an active sponsor or owner is not just administratively untidy, it is operationally ambiguous. When no living account can validate purpose and permissions, access outlives the human process supposed to contain it. The field should treat accountable ownership as a first-class governance property for non-human identities, not a clerical detail.

Trust configuration is an identity control, not just a collaboration or mail setting. Anonymous SharePoint access and unauthenticated Exchange relay both remove the requirement to bind access to a known principal. That matters because attribution, revocation, and investigation all depend on identity being preserved at the boundary. Identity attack paths become easier to create when convenience settings quietly replace identity-backed control with anonymous reach.

Domain controller encryption is a privilege boundary for stored identity material. Weak or missing BitLocker protection on a domain controller creates a governance assumption that only live systems matter. That assumption fails when attackers can copy disks or snapshots and extract directory secrets offline. The implication is that identity programmes must treat stored directory data as part of the access surface, not a passive backup asset.

Control drift across Microsoft identity surfaces is the real pattern. The common failure mode here is not a single product weakness but the spread of permissive states across identity, collaboration, and directory layers. That is why continuous detection of ownership gaps, sharing exposure, relay trust, and encryption policy belongs in the same governance conversation. Practitioners should read these signals as evidence that identity assurance now depends on configuration state, not only on login events.

What this signals

Ownership gaps are becoming a distinct identity risk class. Programmes that track accounts but not accountable sponsorship will miss the point when a machine or agent identity keeps running after the human who should oversee it is no longer able to act. The control question is no longer only whether access exists, but whether someone can still justify and revoke it when conditions change.

Microsoft 365 trust settings need the same scrutiny as privileged access paths. Anonymous sharing and unauthenticated relay are not side issues because they sit on the route attackers use to make access look legitimate. Teams should expect identity assurance reviews to expand from login and role checks into collaboration, mail, and directory configuration state.

Control state, not just threat activity, will drive next-step governance. As identity environments add agent identities, shared content, and hybrid directory dependencies, detection has to watch for governance drift that creates attack paths before exploitation begins. Practitioners should align continuous monitoring with the places where identity can be used without the normal verification chain.

For practitioners

• Establish active sponsorship for every agent identity Require each Microsoft Entra agent identity to have a live owner and sponsor who can review purpose, permissions, and lifecycle status without delay. See the Microsoft Entra Agent ID Guide.
• Constrain anonymous collaboration paths Reduce SharePoint external sharing to guest-based or more restrictive modes and review any link exposure that does not require sign-in.
• Lock down inbound relay sources Restrict Exchange Online connectors to authenticated or tightly IP-restricted sources so mail cannot pass through a trusted tenant boundary without verification.
• Validate domain controller encryption coverage Confirm that domain controller volumes, backups, and snapshots are protected by strong BitLocker policy with recovery information handled separately from the affected environment.
• Trace attack paths across Microsoft identity layers Use identity attack-path analysis to identify where ownership gaps, anonymous sharing, relay connectors, and directory access combine into a single escalation route.

Key takeaways

• Agent identities create governance problems when no active owner or sponsor remains able to validate their purpose and permissions.
• Permissive sharing and relay settings weaken identity-backed accountability by letting access or message flow proceed without a verified principal.
• Weak domain controller encryption can expose directory secrets offline, so stored identity data must be treated as part of the access surface.

Related NHI Mgmt Group resources: Microsoft Entra Agent ID Guide · SharePoint and OneDrive Security Guide · Active Directory and Entra ID Hardening Guide · Identity Attack Paths Guide

Key terms

• Agent Identity: An agent identity is the set of attributes, credentials and permissions assigned to an autonomous software entity. It is treated as a non-human identity because it can authenticate, act on systems and accumulate access over time, which creates governance, audit and lifecycle obligations similar to other production identities.
• Sponsor: A Sponsor is the business accountability role for an agent identity. The sponsor answers whether the agent still exists for a valid reason and participates in access-package and lifecycle decisions, but does not replace the technical owner or the user-account manager.
• Anonymous Sharing: Anonymous sharing is a link-based access model that lets anyone with the link view or sometimes edit content without authenticating. It is convenient for external collaboration, but it also expands the risk of uncontrolled distribution, weak accountability, and accidental exposure if link settings are not tightly managed.
• Unauthenticated Backend Relay: An unauthenticated backend relay is a server-side proxy that forwards requests without verifying who sent them. It shifts the secret off the device but leaves the service open to abuse because the attacker only needs access to the relay endpoint.

Deepen your knowledge

NHI governance, agentic AI identity, and machine identity lifecycle are core topics in our NHI Foundation Level course, the industry's only accredited NHI security programme. If you are building or maturing an IAM programme, it is worth exploring.