MT.1081 - Hybrid users should not be assigned Entra ID role assignments.
Overview
Microsoft strongly recommends avoiding the use of synchronized identities to manage Microsoft 365 or Microsoft Entra environments for protecting against on-premises attacks.
How to fix
Create dedicated privileged users to assign and use Entra ID roles, and remove the previous role assignments for the on-premises accounts.
Test Metadata
| Field | Value |
|---|---|
| Test ID | MT.1081 |
| Severity | Medium |
| Suite | Maester |
| Product | Defender |
| Related products | Entra ID |
| Feature | Exposure Management |
| Area | Privileged access |
| Resource type | User |
| User impact | Low |
| Implementation cost | Medium |
| MITRE ATT&CK | T1078.002 Domain Accounts, T1078.004 Cloud Accounts, T1556.007 Hybrid Identity |
| Supports controls | nist-800-53-r5:AC-6(5) |
| PowerShell test | Test-MtXspmHybridUsersWithAssignedEntraIdRoles |
| Services | Graph |
| Long running | Yes |
Source
- Test:
tests/maester/xspm/Test.MT.1081.ps1 - Documentation:
tests/maester/xspm/Test.MT.1081.md