MT.1147 - Do not sync krbtgt_AzureAD to Entra ID.
Overview
Ensure krbtgt_AzureAD is not synchronized from on-premises Active Directory.
The krbtgt_AzureAD account is a sensitive identity used by Microsoft's cloud services for Microsoft Entra Kerberos scenarios. Microsoft recommends keeping a clear separation between cloud and on-premises environments and not synchronizing this account to Entra ID. Synchronizing an on-premises krbtgt_AzureAD account creates an unnecessary privilege escalation path between the environments.
Remediation action
- Review your Microsoft Entra Connect synchronization scope and identify the on-premises krbtgt_AzureAD account.
- Exclude that account from synchronization, for example by OU filtering or domain filtering, so it is not synced to Entra ID.
- Run a synchronization cycle and confirm that no synchronized krbtgt_AzureAD account remains in Entra ID.
Related links
- Security considerations for Microsoft Entra Kerberos | Microsoft Learn
- Microsoft Entra Connect Sync: Configure filtering | Microsoft Learn
- Microsoft Entra admin center - Microsoft Entra Connect
Test Metadata
| Field | Value |
|---|---|
| Test ID | MT.1147 |
| Severity | High |
| Suite | Maester |
| Product | Entra ID |
| Related products | Active Directory |
| Feature | Hybrid identity |
| Area | Infrastructure hardening |
| Resource type | User |
| User impact | Low |
| Implementation cost | Low |
| MITRE ATT&CK | T1558 Steal or Forge Kerberos Tickets |
| Supports controls | nist-800-53-r5:IA-5, nist-800-53-r5:AC-6 |
| PowerShell test | Test-MtKrbtgtAzureADNotSynced |
| Services | Graph |
Source
- Test:
tests/maester/entra/Test.MT.1147.ps1 - Documentation:
tests/maester/entra/Test.MT.1147.md