Vuln: CVE-2025-55241 | Detection.FYI

Entra ID Actor Token User Impersonation Abuse

Sep 19, 2026 · Domain: Cloud Domain: Identity Data Source: Azure Data Source: Entra ID Data Source: Entra ID Audit Logs Data Source: Entra Audit Logs Use Case: Identity and Access Audit Use Case: Threat Detection Tactic: Initial Access Tactic: Privilege Escalation Resources: Investigation Guide Noise: Low Performance: Normal Profile: Recommended Threat: Vulnerability Exploit Rule Type: ES|QL Platform: Entra ID Vuln: CVE-2025-55241 ·
Share on:

Identifies potential abuse of actor tokens in Microsoft Entra ID audit logs. Actor tokens are undocumented backend mechanisms used by Microsoft for service-to-service (S2S) operations, allowing services to perform actions on behalf of users. These tokens appear in logs with the service's display name but the impersonated user's UPN. While some legitimate Microsoft operations use actor tokens, unexpected usage may indicate exploitation of CVE-2025-55241, which allowed unauthorized access to Azure AD Graph API across tenants before being patched by Microsoft.

Read More