# Privileged accounts are cloud native identities
If an on-premises account is compromised and is synchronized to Microsoft Entra, the attacker might gain access to the tenant as well.
Source: https://maester.dev/docs/tests/ZTA.21814
:::note[Maester checks this too]
[CIS.M365.1.1.1](/docs/tests/CIS.M365.1.1.1) (Ensure Administrative accounts are cloud-only), [CISA.MS.AAD.7.3](/docs/tests/CISA.MS.AAD.7.3) (Privileged users SHALL be provisioned cloud-only accounts separate from an on-premises directory or other federated identity providers.) check the same setting. Running both reports it twice.
:::
## Overview
If an on-premises account is compromised and is synchronized to Microsoft Entra, the attacker might gain access to the tenant as well. This risk increases because on-premises environments typically have more attack surfaces due to older infrastructure and limited security controls. Attackers might also target the infrastructure and tools used to enable connectivity between on-premises environments and Microsoft Entra. These targets might include tools like Microsoft Entra Connect or Active Directory Federation Services, where they could impersonate or otherwise manipulate other on-premises user accounts.
If privileged cloud accounts are synchronized with on-premises accounts, an attacker who acquires credentials for on-premises can use those same credentials to access cloud resources and move laterally to the cloud environment.
## Remediation
- [Protecting Microsoft 365 from on-premises attacks](https://learn.microsoft.com/entra/architecture/protect-m365-from-on-premises-attacks?wt.mc_id=zerotrustrecommendations_automation_content_cnl_csasci#specific-security-recommendations)
For each role with high privileges (assigned permanently or eligible through Microsoft Entra Privileged Identity Management), you should do the following actions:
- Review the users that have onPremisesImmutableId and onPremisesSyncEnabled set. See [Microsoft Graph API user resource type](https://learn.microsoft.com/graph/api/resources/user?wt.mc_id=zerotrustrecommendations_automation_content_cnl_csasci).
- Create cloud-only user accounts for those individuals and remove their hybrid identity from privileged roles.
## Run it
The check runs as part of the whole assessment, with the ZeroTrustAssessment module installed:
```powershell
Install-Module ZeroTrustAssessment -Scope CurrentUser
Connect-Maester
Invoke-Maester -Pack ZTA -SkipBuiltIn
```
Leave out `-SkipBuiltIn` to run Maester's own checks in the same run.
About this check
| | |
| --- | --- |
| Severity | High |
| Effort to fix | Medium |
| Impact on users | Low |
| Pillar | Identity |
| Category | Privileged access |
| Product | [Entra ID](/docs/tests/products/entra) |
| Feature | Roles and administrators |
| Area | Privileged access |
| ATT&CK | [T1556.007](/docs/tests?mitre=T1556.007) Hybrid Identity, [T1078.002](/docs/tests?mitre=T1078.002) Domain Accounts, [T1078.004](/docs/tests?mitre=T1078.004) Cloud Accounts |
| Tenant | Workforce |
Product, feature, area and ATT&CK are Maester's: the assessment does not record them, so Maester keeps them in the pack's `taxonomy.json`.