EIDPIM-005: Privileged Role Assignments to Synced Accounts
- Platform
- Entra ID / M365
- Category
- Entra ID Privileged Identity Management
- Severity
- High
- Zero Trust pillar
- Identity (weight 2)
- Golden fixtures
- 4
- Branch coverage
- Observed: fixtures prove the verdicts they exercise
- Provenance
- baseline
What it checks
Accounts synchronized from on-premises Active Directory via Entra Connect that hold privileged cloud roles create a dangerous hybrid attack path. If the on-premises environment is compromised, an attacker can manipulate synced account credentials or attributes to gain administrative access to the cloud tenant. Cloud-privileged roles should only be assigned to cloud-only accounts to maintain a security boundary between on-premises and cloud environments
Recommended value
No synced (hybrid) accounts assigned to privileged Entra ID roles. All privileged accounts should be cloud-only
Remediation
Identify all privileged role members whose onPremisesSyncEnabled property is true. Create dedicated cloud-only administrative accounts for each administrator and assign the required privileged roles to these new accounts. Remove privileged role assignments from all synced accounts to eliminate the on-premises to cloud escalation path
Fixture-proven verdicts
Every verdict below is proven by a golden fixture in the module's gating test suite. This table derives from the last green run; it cannot be edited by hand.
| Scenario | Expected verdict |
|---|---|
| clean | PASS |
| known-bad | FAIL |
| partial-collection | Not Assessed |
| throttled | Not Assessed |
Framework mappings
- CISA SCuBA
- MS.AAD.7.3v1
- NIST SP 800-53
- AC-6(5)
- MITRE ATT&CK
- T1078.004