What this check looks at
Identifies directory-synchronised accounts that hold privileged cloud roles.
In a hybrid tenant, Microsoft Entra Connect Sync or Cloud Sync copies user accounts from on-premises Active Directory into Microsoft Entra ID. A synchronised account’s password, enabled state and most attributes are controlled from Active Directory, and with password hash sync or pass-through authentication the on-premises password is the cloud password. When such an account holds a privileged cloud role, whoever controls the account in Active Directory controls the role in Microsoft 365.
This check takes every holder of a privileged Microsoft Entra role and checks whether the account is synchronised from on-premises. The check fails when any privileged role holder is synchronised (high severity when more than half of them are). It warns when every role holder it could confirm is cloud-only but the sync state of some was not returned.
Ransomware groups routinely take over on-premises Active Directory first, through a phished workstation, an unpatched server or a weak service account. With domain admin rights they can reset the password of a synchronised account that holds Global Administrator and walk straight into Microsoft 365 to delete data, read mail and disable security settings. A cloud-only admin account has no on-premises object to attack, so a compromised domain stays an on-premises incident.
Why it matters
A synchronised admin account means a compromise of Active Directory becomes a compromise of Microsoft 365. It breaks the security boundary between on-premises and cloud, which is the whole point of separate cloud administrative identities.
A typical case: a 120-person manufacturer is hit by ransomware through an exposed remote desktop server. The attackers gain domain admin, reset the IT manager’s synchronised account, which holds Global Administrator, and use it to delete SharePoint and OneDrive content and remove the backup product’s access. What should have been an on-premises incident with clean cloud data becomes the loss of both, and recovery runs to weeks.
Cloud-only administrator accounts are cheap: they need no mailbox licence and take minutes to create. They also mean the account a person uses for email and web browsing never holds admin rights, which is Microsoft’s own guidance for protecting Microsoft 365 from on-premises attacks.
CIS Microsoft 365 Foundations Benchmark 1.1.1 asks for administrative accounts to be cloud-only, CISA SCuBA MS.AAD.7.3 requires privileged users to have cloud-only accounts, and CIS Controls v8 safeguard 5.4 requires dedicated administrator accounts. ISO 27001 A.8.2, the NCSC CAF privileged user management outcome and Cyber Essentials’ user access control requirement (separate accounts for administration) point the same way.
How to fix it
Where: Entra admin centre → Identity → Roles and administrators
Before you start
- Create a cloud-only admin account (for example admin-jsmith@tenant.onmicrosoft.com) for each person, with MFA registered, before removing the role from the synchronised account.
Step by step
- List the accounts and roles to move. From the evidence, list each synchronised account and every role it holds; the evidence includes the role names and whether each assignment is active or eligible. In the Microsoft Entra admin centre, Entra ID > Users, open each account and confirm On-premises sync enabled shows Yes.
- Create a cloud-only admin account for each person. In the Microsoft 365 admin centre, go to Users > Active users > Add a user. Use a clear name on the tenant’s onmicrosoft.com domain, for example adm-jsmith@contoso.onmicrosoft.com. Do not assign a Microsoft 365 licence with a mailbox; assign only Entra ID P1 or P2 if your Conditional Access or PIM design needs it. Untick the option to email the password and set a long random one.
- Register phishing-resistant MFA on the new account. Issue a Temporary Access Pass to the new account (Entra ID > Users > the account > Authentication methods > Add authentication method > Temporary Access Pass). The administrator signs in at https://aka.ms/mysecurityinfo with it and registers a FIDO2 security key or a passkey in Microsoft Authenticator, plus a backup method.
- Assign the roles to the new account. In Entra ID > Roles & admins > Roles & admins, open each role the synchronised account held, select Add assignments and choose the new cloud-only account (as Eligible through Privileged Identity Management if the tenant has Entra ID P2). Ask the administrator to sign in with the new account and confirm they can do their admin work.
- Remove the roles from the synchronised account. Open the synchronised account in Entra ID > Users > Assigned roles, select each privileged role and choose Remove assignment. Check ID Governance > Privileged Identity Management > Microsoft Entra roles > Assignments for eligible assignments on the same account and remove those too. The synchronised account carries on as the person’s everyday identity.
- Keep on-premises admin accounts out of the cloud. On the Entra Connect server, run the Entra Connect wizard and review the organisational unit or group filtering, so that on-premises privileged accounts such as members of Domain Admins are not synchronised at all. They have no reason to exist in Microsoft 365.
- Confirm every role holder is cloud-only. Open each privileged role in use under Entra ID > Roles & admins and check every member is a cloud-only account (On-premises sync enabled: No on the account). The finding clears at the next assessment.
What users will notice
Administrators use a separate admin account for admin work. Their everyday account is unchanged.
How to confirm it worked
Roles and administrators: every privileged assignment belongs to an account whose "On-premises sync enabled" is No.
Frameworks and controls
This check maps to controls in 17 frameworks. Passing it is evidence that the setting is in place, not a certification against any of them.
| Framework | Control |
|---|---|
| Cyber Essentials | User access control |
| Cyber Essentials Plus | Account separation test: admin accounts used only for administrationUser access control |
| NCSC CAF | B2.c Privileged user management |
| DSPT | Standard 4: Managing data access |
| NIS2 | Art. 21(2)(i) Access control and asset management |
| Microsoft Cloud Security Benchmark | PA-1 Separate and limit highly privileged/administrative users |
| Zero Trust | Identities |
| SOC 2 | CC6.3 Role-based access and least privilege |
| PCI DSS 4.0.1 | 7.2.2 Access is assigned by job function with least privilege |
| NIST SP 800-171 | 3.1.6 Use non-privileged accounts for non-security functions |
| CMMC Level 2 | AC.L2-3.1.6 Non-Privileged Account Use |
| ISO 27001:2022 | A.8.2 Privileged access rights |
| CISA SCuBA | MS.AAD.7.3v1 Privileged users have cloud-only accounts |
| CIS M365 | 1.1.1 Ensure administrative accounts are cloud-only |
| CIS Controls v8.1 | 5.4 Restrict administrator privileges to dedicated administrator accounts (IG1) |
| NIST CSF 2.0 | PR.AA-05: Access permissions, entitlements, and authorizations are defined in a policy, managed, enforced, and reviewed, and incorporate the principles of least privilege and separation of duties |
| NCSC 10 Steps | Identity and access management |
The framework mappings were last checked against the published standards in October 2026.
Microsoft’s documentation
- Protecting Microsoft 365 from on-premises attacks (Microsoft Learn)