Microsoft Patches Critical Entra ID Flaw Enabling Global Admin Impersonation Across Tenants

A critical token validation failure in Microsoft Entra ID (formerly Azure Active Directory) could have allowed attackers to impersonate any user, including Global Administrators, across any tenant. The vulnerability, tracked as CVE-2025-55241, has been assigned a maximum CVSS score of 10.0 and has been described by Microsoft as a privilege escalation flaw in Azure Entra; there is no indication it was exploited in the wild. It was addressed by the Windows maker as of 17 July 2025, requiring no customer action.

Security researcher Dirk-jan Mollema disclosed the flaw after discovering and reporting it on 14 July, noting that it could compromise every Entra ID tenant worldwide, with likely exceptions for national cloud deployments. The issue stems from a combination of service-to-service actor tokens issued by the Access Control Service and a legacy Azure AD Graph API that did not adequately validate the originating tenant, enabling cross-tenant access.

Microsoft also notes that the Azure AD Graph API has been deprecated and retired as of 31 August 2025, with guidance to migrate to Microsoft Graph. According to Microsoft, such cross-tenant access is described as “High-privileged access,” which can permit impersonation and unauthorized modifications under conditional access policies, potentially leaving little trace due to a lack of API-level logging for the Graph API.