All users with administrative roles are cloud-only accounts

​

What this check verifies

Microsoft Entra administrative users are evaluated to confirm they are cloud-only accounts, with no on-premises directory synchronization for any user holding privileged roles.

​

Risk

On-premises-synced privileged accounts extend the cloud trust boundary to AD. If AD or the sync channel is compromised, attackers can:

• Escalate into Entra roles
• Alter tenant settings and access data
• Maintain persistence via on-prem credentials

This harms confidentiality and integrity and complicates recovery.

​

Recommendation

Assign Entra roles only to cloud-native accounts. Enforce least privilege, MFA, and Conditional Access; use PIM for just-in-time elevation. Maintain cloud-only break-glass accounts, perform periodic access reviews, and prohibit synced identities from holding privileged roles for defense in depth.

​

Remediation

​

References

• https://learn.microsoft.com/en-us/entra/identity/role-based-access-control/best-practices#9-use-cloud-native-accounts-for-microsoft-entra-roles

​

Where this check fires

This check runs on every scheduled scan against your Microsoft 365 account. Findings appear at Cloud Security → Findings filterable by Check ID = entra_admin_users_cloud_only. To re-evaluate after a fix, hit Run now on the account’s schedule under Cloud Security → Schedules — the next scan re-checks this control and marks the finding fixed or keeps it persistent.

---

← Back to Microsoft 365 checks