EIDFED-005: Azure AD Connect Configuration Review
- Plataforma
- Entra ID / M365
- Categoría
- Entra ID Federation & Hybrid Identity
- Severidad
- High
- Pilar de Zero Trust
- Identity (peso 2)
- Fixtures de referencia
- 3
- Cobertura de ramas
- Observada: los fixtures prueban los veredictos que ejercitan
- Procedencia
- baseline
Qué comprueba
Azure AD Connect synchronizes on-premises Active Directory objects to Entra ID and is a critical component of hybrid identity architecture. Misconfigured Azure AD Connect settings can expose sensitive attributes to the cloud, create unintended privilege escalation paths, or allow attackers with on-premises access to manipulate cloud identities. The connector account permissions, synchronization rules, and feature configuration should be reviewed against security best practices.
Valor recomendado
Azure AD Connect configured with least-privilege connector accounts, hardened synchronization rules, and all security features enabled
Remediación
Review the Azure AD Connect configuration including the connector account permissions, synchronization rules, and enabled features. Ensure the AD DS connector account uses the minimum required permissions and that the Entra ID connector account is a dedicated cloud-only service account. Verify that the Azure AD Connect server is treated as a Tier 0 asset with restricted administrative access and comprehensive monitoring.
Veredictos probados con fixtures
Cada veredicto de esta tabla está probado por un fixture de referencia en la suite de pruebas que valida el módulo. La tabla se deriva de la última ejecución en verde; no puede editarse a mano.
| Escenario | Veredicto esperado |
|---|---|
| clean | PASS |
| known-bad | WARN |
| no-data | Not Assessed |
Mapeos a marcos de referencia
- NIST SP 800-53
- CM-6
- MITRE ATT&CK
- T1078.004