Topic starter
24/06/2026 8:56 pm
TL;DR: Actor tokens in Microsoft Entra ID let attackers impersonate users across tenants, bypass Conditional Access, and leave little victim-side logging, according to Fabrix Security's analysis of CVE-2025-55241. The real governance failure is not just patching a flaw, but removing legacy delegation paths that break tenant binding, revocation, and auditability.
Editorial analysis by NHI Mgmt Group, based on content published by Fabrix Security: “Cross-Tenant Admin Impersonation in Entra ID”.
By the numbers:
- Only 5.7% of organisations have full visibility into their service accounts, according to the Ultimate Guide to NHIs.
Key questions
Q: What breaks when legacy tenant delegation paths are still active in Entra ID?
A: Legacy delegation paths can break tenant binding, revocation, and auditability at the same time.
Q: Why does weak issuer validation create tenant-wide impersonation risk?
A: Because issuer validation is what keeps one tenant’s identity artefacts from being replayed into another tenant’s trust boundary.
Q: How can security teams tell whether an identity path is still safe to keep?
A: A path is not safe if it depends on deprecated APIs, undocumented tokens, or trust assumptions that are no longer enforced in the platform.
Practitioner guidance
- Audit and remove legacy delegation paths Identify any remaining flows that depend on Azure AD Graph or undocumented impersonation behaviour, then decommission them in favour of Microsoft Graph and supported identity patterns.
- Enforce zero standing Global Admin privilege Replace permanent Global Admin assignments with JIT elevation, and verify that no admin role remains continuously active without a time bound.
- Validate tenant and issuer binding at the API edge Review identity integrations to ensure issuer, audience, and tenant context are checked before a token can be accepted for authorization.
Bottom line: The article shows how undocumented Actor tokens became a cross-tenant impersonation path once tenant and issuer validation were not enforced.
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
25/06/2026 5:50 am
Legacy delegation becomes identity debt the moment it outlives tenant binding. Actor tokens were designed for a special delegation path, but that design assumed issuer and tenant checks would remain trustworthy. Once the Azure AD Graph API stopped enforcing those boundaries strictly, the token stopped being a controlled delegation artefact and became an impersonation primitive. The practitioner lesson is that undocumented identity paths cannot be allowed to survive as normal operations.
A few things that frame the scale:
- Impersonation fraud accounted for over 85% of all fraud attacks in 2025.
A question worth separating out:
Q: What should teams do after a forged admin session in Entra ID?
A: Treat the session as the start of persistence hunting, not the end of the incident. Look for long-lived secrets, new service principals, hidden role grants, and any change that would let the attacker return without repeating the original exploit.
👉 Read our full editorial: Actor token abuse in Entra ID exposes tenant-wide impersonation