Privileged accounts are cloud native identities

Maester checks this too

CIS.M365.1.1.1 (Ensure Administrative accounts are cloud-only), CISA.MS.AAD.7.3 (Privileged users SHALL be provisioned cloud-only accounts separate from an on-premises directory or other federated identity providers.) check the same setting. Running both reports it twice.

Overview

If an on-premises account is compromised and is synchronized to Microsoft Entra, the attacker might gain access to the tenant as well. This risk increases because on-premises environments typically have more attack surfaces due to older infrastructure and limited security controls. Attackers might also target the infrastructure and tools used to enable connectivity between on-premises environments and Microsoft Entra. These targets might include tools like Microsoft Entra Connect or Active Directory Federation Services, where they could impersonate or otherwise manipulate other on-premises user accounts.

If privileged cloud accounts are synchronized with on-premises accounts, an attacker who acquires credentials for on-premises can use those same credentials to access cloud resources and move laterally to the cloud environment.

Remediation

• Protecting Microsoft 365 from on-premises attacks

For each role with high privileges (assigned permanently or eligible through Microsoft Entra Privileged Identity Management), you should do the following actions:

• Review the users that have onPremisesImmutableId and onPremisesSyncEnabled set. See Microsoft Graph API user resource type.
• Create cloud-only user accounts for those individuals and remove their hybrid identity from privileged roles.

Run it

The check runs as part of the whole assessment, with the ZeroTrustAssessment module installed:

Install-Module ZeroTrustAssessment -Scope CurrentUser
Connect-Maester
Invoke-Maester -Pack ZTA -SkipBuiltIn

Leave out -SkipBuiltIn to run Maester’s own checks in the same run.

About this check

Severity	High
Effort to fix	Medium
Impact on users	Low
Pillar	Identity
Category	Privileged access
Product	Entra ID
Feature	Roles and administrators
Area	Privileged access
ATT&CK	T1556.007 Hybrid Identity, T1078.002 Domain Accounts, T1078.004 Cloud Accounts
Tenant	Workforce

Product, feature, area and ATT&CK are Maester’s: the assessment does not record them, so Maester keeps them in the pack’s taxonomy.json.

A Microsoft check, part of the Zero Trust Assessment pack. Text from ZeroTrustAssessment 3.1.0, © Microsoft, MIT licence.