# Entra Connect Sync is configured with Service Principal Credentials

Microsoft Entra Connect Sync using user accounts instead of service principals creates security vulnerabilities.

Source: https://maester.dev/docs/tests/ZTA.24570

<!-- This file is generated by website/scripts/generate-test-docs.mjs. Do not edit manually. -->

## Overview

Microsoft Entra Connect Sync using user accounts instead of service principals creates security vulnerabilities. Legacy user account authentication with passwords is more susceptible to credential theft and password attacks than service principal authentication with certificates. Compromised connector accounts allow threat actors to manipulate identity synchronization, create backdoor accounts, escalate privileges, or disrupt hybrid identity infrastructure.

## Remediation

- [Configure service principal authentication for Entra Connect](https://learn.microsoft.com/entra/identity/hybrid/connect/authenticate-application-id?tabs=default&wt.mc_id=zerotrustrecommendations_automation_content_cnl_csasci#onboard-to-application-based-authentication)
- [Remove legacy Directory Synchronization Accounts](https://learn.microsoft.com/entra/identity/hybrid/connect/authenticate-application-id?tabs=default&wt.mc_id=zerotrustrecommendations_automation_content_cnl_csasci#remove-a-legacy-service-account)

## Run it

The check runs as part of the whole assessment, with the ZeroTrustAssessment module installed:

```powershell
Install-Module ZeroTrustAssessment -Scope CurrentUser
Connect-Maester
Invoke-Maester -Pack ZTA -SkipBuiltIn
```

Leave out `-SkipBuiltIn` to run Maester's own checks in the same run.

<details>
<summary>About this check</summary>

| | |
| --- | --- |
| Severity | High |
| Effort to fix | Medium |
| Impact on users | Low |
| Pillar | Identity |
| Category | Hybrid infrastructure |
| Product | [Entra ID](/docs/tests/products/entra) |
| Feature | Hybrid identity |
| Area | Authentication |
| ATT&CK | [T1078.004](/docs/tests?mitre=T1078.004) Cloud Accounts, [T1110](/docs/tests?mitre=T1110) Brute Force |
| Licence | Free |
| Tenant | Workforce |

Product, feature, area and ATT&CK are Maester's: the assessment does not record them, so Maester keeps them in the pack's `taxonomy.json`.

</details>

<p class="mt-ms-note not-content"><svg class="mt-ms-note__logo" viewBox="0 0 21 21" aria-hidden="true"><rect width="10" height="10" fill="#f25022"/><rect x="11" width="10" height="10" fill="#7fba00"/><rect y="11" width="10" height="10" fill="#00a4ef"/><rect x="11" y="11" width="10" height="10" fill="#ffb900"/></svg><span>A Microsoft check, part of the <a href="/docs/tests/packs/zero-trust-assessment">Zero Trust Assessment</a> pack. Text from ZeroTrustAssessment 3.1.0, © Microsoft, <a href="/docs/tests/packs/zero-trust-assessment#licence">MIT licence</a>.</span></p>