EIDFED-012: Cloud-Only vs Synced Account Analysis
- Plataforma
- Entra ID / M365
- Categoría
- Entra ID Federation & Hybrid Identity
- Severidad
- Info
- Pilar de Zero Trust
- Identity (peso 1)
- Fixtures de referencia
- 2
- Cobertura de ramas
- Observada: los fixtures prueban los veredictos que ejercitan
- Procedencia
- baseline
Qué comprueba
Understanding the distribution of cloud-only versus on-premises-synced accounts provides visibility into the hybrid identity landscape and helps identify potential security gaps. Cloud-only accounts are managed entirely in Entra ID while synced accounts originate from on-premises Active Directory and inherit its security posture. This analysis helps identify accounts that should be cloud-only but are being synced, or vice versa, and informs decisions about authentication method selection and security control placement.
Valor recomendado
All accounts categorized as cloud-only or synced with documentation of the expected state for each account type and role
Remediación
Export all user accounts from Entra ID and categorize them by the onPremisesSyncEnabled property to determine which accounts are synced from on-premises versus cloud-only. Verify that privileged administrative accounts are cloud-only to prevent on-premises compromise from affecting cloud administration. Document the expected identity source for each account type and investigate any accounts whose actual source does not match the expected configuration.
Veredictos probados con fixtures
Cada veredicto de esta tabla está probado por un fixture de referencia en la suite de pruebas que valida el módulo. La tabla se deriva de la última ejecución en verde; no puede editarse a mano.
| Escenario | Veredicto esperado |
|---|---|
| clean | PASS |
| no-data | Not Assessed |
Mapeos a marcos de referencia
- NIST SP 800-53
- AC-2