MS.AAD.7.3v1 - Privileged users SHALL be provisioned cloud-only accounts separate from an on-premises directory or other federated identity providers.

Information

By provisioning cloud-only Microsoft Entra ID user accounts to privileged users, the risks associated with a compromise of on-premises federation infrastructure are reduced. It is more challenging for the adversary to pivot from the compromised environment to the cloud with privileged access.

Solution

1. Perform the steps below for each highly privileged role. We reference the Global Administrator role as an example.

2. Create a list of all the users assigned to the Global Administrator role. Include users that are assigned directly to the role and users assigned via group membership. If you have Microsoft Entra ID PIM, include both the Eligible assignments and Active assignments. If any of the groups assigned to Global Administrator are enrolled in PIM for Groups, also include group members from the PIM for Groups portal Eligible assignments.

3. For each highly privileged user in the list, execute the Powershell code below but replace the `[email protected]` with the principal name of the user who is specific to your environment. You can get the data value from the Principal name field displayed in the Microsoft Entra ID portal.

Connect-MgGraph
Get-MgBetaUser -Filter "userPrincipalName eq '[email protected]'" | FL

6. Review the output field named OnPremisesImmutableId. If this field contains a data value, it means that the user is not cloud-only. If the user is not cloud-only, create a cloud-only account for that user, assign the user to their respective roles and then remove the account that is not cloud-only from Microsoft Entra ID.

See Also

https://github.com/cisagov/ScubaGear/tree/v1.5.0/

Item Details

Category: ACCESS CONTROL, AUDIT AND ACCOUNTABILITY, IDENTIFICATION AND AUTHENTICATION

References: 800-53|AC-1, 800-53|AC-2, 800-53|AC-3, 800-53|AC-6, 800-53|AU-1, 800-53|AU-2, 800-53|IA-2, 800-53|IA-11

Plugin: microsoft_azure

Control ID: 9f61ab37d1694af3f1808e1508295f1a2299d2fc812a37d92b4d13667bc65292