MT.1026 - No hybrid user with permanent role assignment on Control Plane.
Overview
GET /beta/roleManagement/directory/roleAssignments?$expand=principal
Remediation action
Review the configuration described above.
Test Metadata
| Field | Value |
|---|---|
| Test ID | MT.1026 |
| Severity | High |
| Suite | Maester |
| Product | Entra ID |
| Feature | Roles and administrators |
| Area | Privileged access |
| Resource type | User |
| User impact | Low |
| Implementation cost | Medium |
| MITRE ATT&CK | T1078.004 Cloud Accounts, T1556.007 Hybrid Identity, T1078.002 Domain Accounts |
| Supports controls | nist-800-53-r5:AC-6(5), nist-800-53-r5:AC-2(7) |
| PowerShell test | Test-MtCheckMT1026 |
| Services | Graph |
Source
- Test:
tests/maester/entra/Test.MT.1026.ps1 - Documentation:
tests/maester/entra/Test.MT.1026.md