Entra ID and Hybrid Checks: Admin Roles, Conditional Access and Hard-Match Takeover

Overview

The Entra ID and hybrid category on the Security Posture page (Exposure > Security Posture) checks the places where a Microsoft Entra ID tenant gets taken over. It covers tenant-wide settings such as user consent and device code sign-in, who holds admin roles and how, and the links between your tenant and on-premises Active Directory, such as hard-match takeover and the seamless single sign-on key.

The checks run after each Entra ID sync, with nothing to turn on. Each failing check becomes a finding with the setting or role named as the Microsoft Entra admin center names it. A tenant-wide check reports on the tenant. A role check reports on each account or group that holds the role.

Two things decide whether a check can reach a verdict: the Microsoft Graph permissions your app registration holds, and the Microsoft Entra ID license your tenant has. Both are covered below, so a check never reads as passing when GraphnAI couldn't see the data.

---

Prerequisites

• Role: Operator or Admin to see findings. Viewers don't see the Security Posture page. Only an Admin can change the two lists described below.

• Data: A synced Entra ID tenant. See Entra ID Manual Setup or Automated Entra ID Setup.

• Permissions: Three required permissions cover the role checks and the tenant details: RoleManagement.Read.Directory, Organization.Read.All and the user and group reads. The tenant-setting checks need the optional Policy.Read.All. Three newer optional permissions unlock one check each:

  Permission	Unlocks
  Policy.Read.All	Guest, app registration, tenant creation and consent settings, security defaults, Conditional Access, authentication strengths and cross-tenant access settings. Ten checks read these.
  Domain-InternalFederation.Read.All	Federated domain trusts the identity provider's multifactor check
  OnPremDirectorySynchronization.Read.All	On-premises accounts can take over cloud accounts
  PrivilegedAssignmentSchedule.Read.AzureADGroup	The group half of Admin role assigned permanently

• Licenses: Two checks need Microsoft Entra ID P2 or Microsoft Entra ID Governance. See License-gated checks.

An app registration made before these permissions existed shows them as Not requested on the Data collected from this tenant card. Select Update the app registration on that card to add them. See Updating an existing app registration.

---

The checks

There are 20. The tables give each title as it appears on the Security Posture page, the severity, and what it checks.

Tenant settings

How the less obvious ones decide:

• No baseline sign-in protection passes when security defaults are on. With them off, it needs an enabled Conditional Access policy that covers all users and all apps, with no location, platform or client-app condition, and requires MFA or a stronger authentication strength. A policy that offers MFA or a weaker control doesn't count. A report-only policy doesn't count.
• Device code sign-in isn't blocked passes on security defaults for a tenant created on or after July 1, 2026. With security defaults off, it needs an enabled, tenant-wide Conditional Access policy that blocks device code flow for all users.
• Admin roles aren't covered by a strong sign-in policy is stricter about exclusions than the two checks above. A policy doesn't cover a role if it excludes any holder of that role, directly or through an excluded group. Designated emergency access accounts are the exception. The finding lists each role, its holder count, and what covers it.
• Federated domain trusts the identity provider's multifactor check fails on Microsoft's default setting for a new federation, acceptIfMfaDoneByFederatedIdp. That's deliberate: a compromised federation server can then satisfy Entra's MFA requirement (Golden SAML).
• Unapproved partner tenant and Unapproved tenant can sync users compare each partner in your cross-tenant access settings with your approved partner tenants. Microsoft service tenants are shown as evidence and never flagged.

Admin roles

Role-assignable groups are expanded one level. A Global Administrator who is only eligible, or only activated, doesn't count toward either Global Administrator check.

Admin role assigned permanently treats an assignment as permanent when it has no end date, or when it ends more than 365 days from now. PIM's longest time-bound active assignment is one year. For a role-assignable group, the check reads PIM for Groups and judges the group's members. A standing member is reported once, inside the group's finding. GraphnAI reads up to 50 groups per sync. Groups beyond that read Not assessed.

Hybrid

• Admin account is controlled from on-premises names the Active Directory source account when GraphnAI has linked it. Until the link exists, the finding says so. The verdict doesn't depend on the link.
• Single sign-on computer account key is old is an Active Directory check. It reads Doesn't apply on an Entra tenant.
• On-premises accounts can take over cloud accounts applies only to a tenant synced from on-premises. A cloud-only tenant passes. Microsoft already blocks hard match into admin accounts, so what remains at risk is takeover of non-admin cloud accounts.

---

Result states

Each check reads Passing, Failing, Not assessed or Doesn't apply, as on the other posture checks. Two states need extra explanation for this category.

License-gated checks

Admin role assigned permanently and Global Administrator activation doesn't need approval both read PIM data, so they need Microsoft Entra ID P2 or Microsoft Entra ID Governance. On a tenant without it, they read Doesn't apply with this line:

Needs Microsoft Entra ID P2 or Microsoft Entra ID Governance. This tenant doesn't have it.

A missing license is never counted against your grade. You can't fix it from GraphnAI, and the check never reports Failing or Passing without it. If the license can't be read on the last sync, the two checks read Not assessed instead.

Not assessed

A check reads Not assessed when it couldn't look at the data. The line names what's missing. The usual reasons:

• A permission isn't granted. The line reads "data for {data set} wasn't fully collected on the last sync", for example "Federated domain settings". Open the Data collected from this tenant card on Admin > Identity Providers and grant or add the permission.
• The data wasn't collected on the last sync. A failed or partial read leaves a check unassessed. The prior result stands until the next sync completes. Right after an upgrade, checks that read new data read Not assessed until the tenant's next sync.
• The license is unknown. The line reads "this tenant's license couldn't be read on the last sync".
• Conditional Access on a tenant without P1 or P2. If the tenant has Conditional Access policies but no Microsoft Entra ID P1 or P2 license, the check reads Not assessed. The license may have lapsed. The policies still exist, and Microsoft doesn't say whether they're enforced.
• Device code sign-in on an older tenant. With security defaults on, a tenant created before July 2026 reads Not assessed for device code sign-in. Microsoft doesn't show whether security defaults block it there.
• A consent policy GraphnAI can't classify. A custom user consent policy reads Not assessed, with its name.

---

Step-by-step

View the findings

1. Open Exposure > Security Posture.
2. Select the Entra ID and hybrid category.
3. Select a row to open the finding's drawer. It shows the setting or role in the admin center's words, the evidence, Why this matters and How to fix it.

Designate emergency access accounts

Emergency access accounts, also called break-glass accounts, are cloud-only Global Administrators kept for when normal admin sign-in fails. Microsoft recommends assigning them permanently and excluding them from Conditional Access. Without a designation, GraphnAI reports them like any other account.

To designate one (Admin only):

1. Open Admin > Identity Providers and choose the Entra ID tenant.
2. In the Emergency access accounts card, enter the account's Object ID from the Microsoft Entra admin center. Add a Label if you want one.
3. Select Add account.

To add a suggestion, select it under Suggested accounts. Suggestions are Global Administrators that are cloud-only and excluded from every Conditional Access policy. Add one only if it's an emergency access account.

To remove an account, select Remove on its row.

What designating an account does:

• Its Global Administrator assignments aren't reported as permanent by Admin role assigned permanently.
• Excluding it from a Conditional Access policy isn't counted as a gap by Admin roles aren't covered by a strong sign-in policy.
• Its admin roles are never offered for removal in an access plan. If a plan built earlier tries to remove one, the removal is refused.

What it doesn't do:

• Its other admin roles are still checked. A designated account that also holds Privileged Role Administrator permanently still fails the permanent assignment check for that role.
• It still counts toward the Global Administrator totals.
• It doesn't change any other check's result.

Limits: up to 10 accounts per tenant. Changes apply from the next sync. The card shows Not found in the last sync for an object ID GraphnAI hasn't seen, and the designation is kept anyway. Every change is recorded in the audit log.

Approve partner tenants

The two cross-tenant partner checks flag partners that nobody approved. Approving a partner tells them you trust it.

To approve one (Admin only):

1. Open Admin > Identity Providers and choose the Entra ID tenant.
2. In the Approved partner tenants card, enter the partner's Tenant ID and an optional Name.
3. Select Add tenant.

Other Entra ID tenants connected to GraphnAI appear under Other connected tenants. Select Approve on one if this tenant should trust it. GraphnAI never approves a tenant for you.

To stop trusting a partner, select Remove on its row.

Approval affects only these two checks, Unapproved partner tenant's sign-in claims are trusted and Unapproved tenant can sync users into this tenant. It doesn't change the trust settings in Microsoft Entra. The default-settings check, Every external tenant's sign-in claims are trusted, ignores the list. Limits: up to 500 tenants, each list per tenant, and changes apply from the next sync.

Fix a finding

Three checks offer role removal through the access plan:

• More than five Global Administrators
• Guest or external account holds an admin role
• Unexpected holder of a directory sync role

To remove a role, open the finding's drawer and use Select Fire. It opens the access plan, which lists the assignments that would change before anything runs. See Select Fire. The step is manual only and never preselected. Removing the sync role from the account that Microsoft Entra Connect or cloud sync uses stops directory synchronization until you restore it.

Every other check is a manual fix. The finding names the admin center setting and where to find it, for example External Identities > External collaboration settings for guest invites. GraphnAI doesn't change tenant settings, Conditional Access policies or PIM settings.

Two fixes aren't in the admin center:

• On-premises accounts can take over cloud accounts: turn on blockCloudObjectTakeoverThroughHardMatchEnabled and blockSoftMatchEnabled, and turn off allowOnPremUpdateOfOnPremisesObjectIdentifierEnabled. They're set on the onPremisesSynchronization object through Microsoft Graph.
• Federated domain trusts the identity provider's multifactor check: set the domain's multifactor behavior to Always require Microsoft Entra multifactor. The federatedIdpMfaBehavior property of its federation configuration sets it through Microsoft Graph.

---

Configuration

Both lists live on Admin > Identity Providers, in the section for each Entra ID tenant. Both are per tenant, Admin only, and refused while the license is read-only.

Add the permissions above to your app registration in the Microsoft Entra admin center, or select Update the app registration on the Data collected from this tenant card.

---

Known limits

• Per-user MFA settings can't be read. Microsoft Graph's stable API doesn't expose them. They never count as coverage, so a tenant that relies on per-user MFA can fail No baseline sign-in protection. The finding says so.

• Seamless single sign-on state isn't visible in Graph. The key-age check can see the AZUREADSSOACC account exists, and it can't tell whether the feature is on. The fix covers both cases: roll the key if it's in use, or delete the computer account from each forest if it's off.

• Conditional Access exclusions weaken the admin role check, and the baseline and device code checks tolerate them. Those two list excluded admins in their evidence.

---

Troubleshooting

A check reads "Not assessed" and names a data set

Open Admin > Identity Providers, choose the tenant, and check Data collected from this tenant. A Not requested or Not approved badge names the permission. Add it or grant consent, then run Sync now.

A check I expected to fail reads "Doesn't apply"

If it's Admin role assigned permanently or Global Administrator activation doesn't need approval, the tenant has no P2 or Governance license. If it's Single sign-on computer account key is old, you're looking at an Entra ID tenant. The check runs on Active Directory.

The designation or approval didn't change a finding

Both lists apply from the next sync. Select Sync now on the tenant, then reload the Security Posture page.

An emergency access account still fails a check

The designation covers Global Administrator assignments and Conditional Access exclusions only. Open the finding to see which other role it holds. If the account doesn't need that role, remove it.

Admin roles show as covered, but an admin signs in without MFA

Check the policy's exclusions in the finding. A policy with a user-level exclusion doesn't cover that holder. Per-user MFA settings aren't visible to GraphnAI.