Hybrid users should not be assigned Entra ID role assignments

Contributed by Thomas NaunheimAll contributors →

Part of Maester · Defender · Exposure Management · All checks

Run this check

Invoke-Maester -TestId MT.1081

Overview

Microsoft strongly recommends avoiding the use of synchronized identities to manage Microsoft 365 or Microsoft Entra environments for protecting against on-premises attacks.

How to fix

Create dedicated privileged users to assign and use Entra ID roles, and remove the previous role assignments for the on-premises accounts.

Details

Every attribute of this check

Field	Value
Test ID	MT.1081
Severity	Medium
Suite	Maester
Product	Defender
Related products	Entra ID
Feature	Exposure Management
Area	Privileged access
Resource type	User
User impact	Low
Implementation cost	Medium
MITRE ATT&CK	T1078.002 Domain Accounts, T1078.004 Cloud Accounts, T1556.007 Hybrid Identity
Supports controls	nist-800-53-r5:AC-6(5)
PowerShell test	Test-MtXspmHybridUsersWithAssignedEntraIdRoles
Services	Graph
Long running	Yes

Source

• Test: tests/maester/xspm/Test.MT.1081.ps1
• Documentation: tests/maester/xspm/Test.MT.1081.md