# Hybrid users should not be assigned Entra ID role assignments
Microsoft strongly recommends avoiding the use of synchronized identities to manage Microsoft 365 or Microsoft Entra environments for protecting against…
Source: https://maester.dev/docs/tests/MT.1081
Part of Maester · Defender · Exposure Management · All checks
```powershell title="Run this check"
Invoke-Maester -TestId MT.1081
```
## Overview
Microsoft strongly recommends avoiding the use of synchronized identities to manage Microsoft 365 or Microsoft Entra environments for [protecting against on-premises attacks](https://learn.microsoft.com/entra/architecture/protect-m365-from-on-premises-attacks).
### How to fix
Create [dedicated privileged users](https://learn.microsoft.com/microsoft-365/enterprise/protect-your-global-administrator-accounts?view=o365-worldwide) to assign and use Entra ID roles, and remove the previous role assignments for the on-premises accounts.
## Details
Every attribute of this check
| Field | Value |
| --- | --- |
| Test ID | MT.1081 |
| Severity | Medium |
| Suite | Maester |
| Product | Defender |
| Related products | Entra ID |
| Feature | Exposure Management |
| Area | Privileged access |
| Resource type | User |
| User impact | Low |
| Implementation cost | Medium |
| MITRE ATT&CK | T1078.002 Domain Accounts, T1078.004 Cloud Accounts, T1556.007 Hybrid Identity |
| Supports controls | nist-800-53-r5:AC-6(5) |
| PowerShell test | [Test-MtXspmHybridUsersWithAssignedEntraIdRoles](https://github.com/maester365/maester/blob/main/tests/maester/xspm/Test.MT.1081.ps1) |
| Services | Graph |
| Long running | Yes |
## Source
- Test: [`tests/maester/xspm/Test.MT.1081.ps1`](https://github.com/maester365/maester/blob/main/tests/maester/xspm/Test.MT.1081.ps1)
- Documentation: [`tests/maester/xspm/Test.MT.1081.md`](https://github.com/maester365/maester/blob/main/tests/maester/xspm/Test.MT.1081.md)
