Privileged users SHALL be provisioned cloud-only accounts separate from an on-premises directory or other federated identity providers

Contributed by Michael Soule with 3 co-contributorsAll contributors →

Part of CISA · Entra ID · Roles and administrators · All checks

Run this check

Invoke-Maester -TestId CISA.MS.AAD.7.3

Overview

Privileged users SHALL be provisioned cloud-only accounts separate from an on-premises directory or other federated identity providers.

Rationale: Many privileged administrative users do not need unfettered access to the tenant to perform their duties. By assigning them to roles based on least privilege, the risks associated with having their accounts compromised are reduced.

Remediation action:

1. Perform the steps below for each highly privileged role.
2. Review the users listed that have an OnPremisesImmutableId and have OnPremisesSyncEnabled set.
3. Create a cloud only user account for that individual and remove their hybrid identity from privileged roles.

Related links

• Entra admin center - Roles and administrators | All roles
• CISA 7.3 Highly Privileged User Access - MS.AAD.7.3v1
• CISA ScubaGear Rego Reference

Details

Every attribute of this check

Field	Value
Test ID	CISA.MS.AAD.7.3
Severity	High
Suite	CISA
Product	Entra ID
Feature	Roles and administrators
Area	Privileged access
Resource type	User
User impact	Low
Implementation cost	Medium
MITRE ATT&CK	T1556.007 Hybrid Identity, T1078.002 Domain Accounts, T1078.004 Cloud Accounts
Supports benchmark	CISA SCuBA Secure Configuration Baselines for Microsoft 365 (version ScubaGear main, 2026-10-11), requirement MS.AAD.7.3
Criticality	SHALL
Upstream requirement	MS.AAD.7.3v1
Supports controls	cisa-scuba:MS.AAD.7.3, nist-800-53-r5:AC-6(5)
PowerShell test	Test-MtCisaCloudGlobalAdmin
Services	Graph

Source

• Test: tests/cisa/entra/Test.CISA.MS.AAD.7.3.ps1
• Documentation: tests/cisa/entra/Test.CISA.MS.AAD.7.3.md