High privileged user should be linked to an identity

Contributed by Thomas NaunheimAll contributors →

Part of Maester · Defender · Exposure Management · All checks

Run this check

Invoke-Maester -TestId MT.1111 -IncludePreview

Overview

Linking a privileged user account to the primary work account in Microsoft Defender XDR makes it easier to detect, prioritize, and contain attacks that target highly sensitive identities. It also improves incident response because all relevant activity and risk signals are correlated to the real person behind both identities, reducing blind spots and investigation time.

This use case is explicitly described in the Defender XDR documentation: A user might have two accounts, one for everyday work and another with elevated permissions for administrative tasks. Example

[email protected] (regular account) [email protected] (privileged account)

How to fix

Review the accounts in the Identity inventory of Microsoft Defender portal and add a manual link from the identity page of the (primary) user account to the privileged account.

Details

Every attribute of this check

Field	Value
Test ID	MT.1111
Severity	Low
Suite	Maester
Product	Defender
Feature	Exposure Management
Area	Privileged access
Resource type	User
User impact	Low
Implementation cost	Low
MITRE ATT&CK	None
Supports controls	nist-800-53-r5:AC-2
PowerShell test	Test-MtXspmPrivilegedUsersLinkedToIdentity
Services	Graph
Lifecycle	Preview
Long running	Yes

Source

• Test: tests/maester/xspm/Test.MT.1111.ps1
• Documentation: tests/maester/xspm/Test.MT.1111.md