# Microsoft Entra Connect synchronization account does not hold unnecessary replication permissions

The Microsoft Entra Connect synchronization account (typically named MSOL_ or ADAAD ) is granted, by default, the directory permissions necessary for the…

Source: https://maester.dev/docs/tests/ZTA.41012

<!-- This file is generated by website/scripts/generate-test-docs.mjs. Do not edit manually. -->

## Overview

The Microsoft Entra Connect synchronization account (typically named `MSOL_<hash>` or `AD_AAD_<hash>`) is granted, by default, the directory permissions necessary for the configured Entra Connect features: writeback, password hash sync, and so on. Replication permissions (`Replicating Directory Changes` and `Replicating Directory Changes All`) are required for password hash synchronization (PHS); remove them only after confirming that PHS and any other legitimate consumers no longer require them. A change of sign-in method or the presence of multiple synchronization accounts alone does not establish that these permissions are unnecessary. When the MSOL_ account holds replication rights it does not need, it becomes a Tier-0 credential whose compromise — through credential extraction on the Entra Connect server or password recovery from the Entra Connect database — enables a threat actor to pull every credential hash from the domain, leading to lateral movement, long-lived authentication forgery, and forest-wide privilege escalation. Microsoft Defender for Identity's "Remove unnecessary replication permissions for Microsoft Entra Connect AD DS Connector account" posture assessment identifies exposed accounts for administrators to review before removing permissions.

## Remediation

- [Remove unnecessary replication permissions for Microsoft Entra Connect AD DS Connector account](https://learn.microsoft.com/en-us/defender-for-identity/security-posture-assessments/hybrid-security#remove-unnecessary-replication-permissions-for-microsoft-entra-connect-ad-ds-connector-account)
- [Microsoft Entra Connect: Accounts and permissions](https://learn.microsoft.com/en-us/entra/identity/hybrid/connect/reference-connect-accounts-permissions)
- [Microsoft Defender for Identity hybrid security posture assessments](https://learn.microsoft.com/en-us/defender-for-identity/security-posture-assessments/hybrid-security)

## Run it

The check runs as part of the whole assessment, with the ZeroTrustAssessment module installed:

```powershell
Install-Module ZeroTrustAssessment -Scope CurrentUser
Connect-Maester
Invoke-Maester -Pack ZTA -SkipBuiltIn
```

Leave out `-SkipBuiltIn` to run Maester's own checks in the same run.

<details>
<summary>About this check</summary>

| | |
| --- | --- |
| Severity | High |
| Effort to fix | Medium |
| Impact on users | Low |
| Pillar | SecOps |
| Category | Identity threat protection |
| Product | [Active Directory](/docs/tests/products/ad) |
| Feature | Permissions and delegation |
| Area | Privileged access |
| ATT&CK | [T1003.006](/docs/tests?mitre=T1003.006) DCSync |
| Licence | ATA |
| Tenant | Workforce |

Product, feature, area and ATT&CK are Maester's: the assessment does not record them, so Maester keeps them in the pack's `taxonomy.json`.

</details>

<p class="mt-ms-note not-content"><svg class="mt-ms-note__logo" viewBox="0 0 21 21" aria-hidden="true"><rect width="10" height="10" fill="#f25022"/><rect x="11" width="10" height="10" fill="#7fba00"/><rect y="11" width="10" height="10" fill="#00a4ef"/><rect x="11" y="11" width="10" height="10" fill="#ffb900"/></svg><span>A Microsoft check, part of the <a href="/docs/tests/packs/zero-trust-assessment">Zero Trust Assessment</a> pack. Text from ZeroTrustAssessment 3.1.0, © Microsoft, <a href="/docs/tests/packs/zero-trust-assessment#licence">MIT licence</a>.</span></p>