EIDPIM-005: Privileged Role Assignments to Synced Accounts
- Plataforma
- Entra ID / M365
- Categoría
- Entra ID Privileged Identity Management
- Severidad
- High
- Pilar de Zero Trust
- Identity (peso 2)
- Fixtures de referencia
- 4
- Cobertura de ramas
- Observada: los fixtures prueban los veredictos que ejercitan
- Procedencia
- baseline
Qué comprueba
Accounts synchronized from on-premises Active Directory via Entra Connect that hold privileged cloud roles create a dangerous hybrid attack path. If the on-premises environment is compromised, an attacker can manipulate synced account credentials or attributes to gain administrative access to the cloud tenant. Cloud-privileged roles should only be assigned to cloud-only accounts to maintain a security boundary between on-premises and cloud environments
Valor recomendado
No synced (hybrid) accounts assigned to privileged Entra ID roles. All privileged accounts should be cloud-only
Remediación
Identify all privileged role members whose onPremisesSyncEnabled property is true. Create dedicated cloud-only administrative accounts for each administrator and assign the required privileged roles to these new accounts. Remove privileged role assignments from all synced accounts to eliminate the on-premises to cloud escalation path
Veredictos probados con fixtures
Cada veredicto de esta tabla está probado por un fixture de referencia en la suite de pruebas que valida el módulo. La tabla se deriva de la última ejecución en verde; no puede editarse a mano.
| Escenario | Veredicto esperado |
|---|---|
| clean | PASS |
| known-bad | FAIL |
| partial-collection | Not Assessed |
| throttled | Not Assessed |
Mapeos a marcos de referencia
- CISA SCuBA
- MS.AAD.7.3v1
- NIST SP 800-53
- AC-6(5)
- MITRE ATT&CK
- T1078.004