Last Change of the Microsoft Entra SSO Account Password

Every Active Directory that uses the Seamless SSO feature of Microsoft Entra ID includes a special computer account, AZUREADSSOACC. This account holds the master secret used to authenticate users from the local domain to Microsoft Entra ID, and it is essential that you must protect it at all costs.

Changing the AZUREADSSOACC account key is a special operation that requires the use of a Microsoft script.

Name: Last Change of the Microsoft Entra SSO Account Password

Codename: C-AAD-SSO-PASSWORD

Severity: High

Type: Active Directory Indicator of Exposure

Family: Authentication and Credentials