Microsoft Entra Connect synchronization account does not hold unnecessary replication permissions

Overview

The Microsoft Entra Connect synchronization account (typically named MSOL_<hash> or AD_AAD_<hash>) is granted, by default, the directory permissions necessary for the configured Entra Connect features: writeback, password hash sync, and so on. Replication permissions (Replicating Directory Changes and Replicating Directory Changes All) are required for password hash synchronization (PHS); remove them only after confirming that PHS and any other legitimate consumers no longer require them. A change of sign-in method or the presence of multiple synchronization accounts alone does not establish that these permissions are unnecessary. When the MSOL_ account holds replication rights it does not need, it becomes a Tier-0 credential whose compromise — through credential extraction on the Entra Connect server or password recovery from the Entra Connect database — enables a threat actor to pull every credential hash from the domain, leading to lateral movement, long-lived authentication forgery, and forest-wide privilege escalation. Microsoft Defender for Identity’s “Remove unnecessary replication permissions for Microsoft Entra Connect AD DS Connector account” posture assessment identifies exposed accounts for administrators to review before removing permissions.

Remediation

• Remove unnecessary replication permissions for Microsoft Entra Connect AD DS Connector account
• Microsoft Entra Connect: Accounts and permissions
• Microsoft Defender for Identity hybrid security posture assessments

Run it

The check runs as part of the whole assessment, with the ZeroTrustAssessment module installed:

Install-Module ZeroTrustAssessment -Scope CurrentUser
Connect-Maester
Invoke-Maester -Pack ZTA -SkipBuiltIn

Leave out -SkipBuiltIn to run Maester’s own checks in the same run.

About this check

Severity	High
Effort to fix	Medium
Impact on users	Low
Pillar	SecOps
Category	Identity threat protection
Product	Active Directory
Feature	Permissions and delegation
Area	Privileged access
ATT&CK	T1003.006 DCSync
Licence	ATA
Tenant	Workforce

Product, feature, area and ATT&CK are Maester’s: the assessment does not record them, so Maester keeps them in the pack’s taxonomy.json.

A Microsoft check, part of the Zero Trust Assessment pack. Text from ZeroTrustAssessment 3.1.0, © Microsoft, MIT licence.