Posture check · Entra ID and hybrid
Admin account is controlled from on-premises (T1078.002, T1556.007)
A synced account holds a tenant-wide admin role. Whoever controls its Active Directory source account controls the cloud admin.
Why it matters
A password reset or attribute write on the on-premises account carries to the cloud account. A domain compromise then becomes a path to the tenant.
How GraphnAI finds it
It runs after every sync, on each connected domain or tenant on its own. It applies to Microsoft Entra ID.
It reads:
- The directory attributes
accountEnabledandonPremisesSyncEnabled - Group memberships
- 2 more GraphnAI analyses
Tiered Fidelity™ level: Theoretical
Every finding from this check carries the Theoretical level.
- TheoreticalThis checkConfigured in the directory. Nothing else checked.
- ConstrainedA constraint on it has been checked.
- ValidatedTelemetry has seen it in use.
Why there's no automatic fix
Replacing a synced admin with a cloud-only account changes who signs in, so an administrator does it.
How to fix it
Give each admin a cloud-only account for admin work. Remove the admin role from the synced account.
Related checks
MITRE ATT&CK® technique names and MITRE D3FEND™ technique labels: © The MITRE Corporation. This work is reproduced and distributed with the permission of The MITRE Corporation. ATT&CK® is a registered trademark and D3FEND™ a trademark of The MITRE Corporation.
See it on your own directory.
The Public Preview is free for 30 days from your first sync, on your own server.