Conditional Access excludes Directory Sync accounts

​

What this check verifies

Conditional Access policies scoped to all users and all cloud applications are evaluated to confirm the Directory Synchronization Accounts role is explicitly excluded. The Microsoft Entra Connect Sync Account does not support multifactor authentication, so it must be excluded from restrictive policies to maintain directory synchronization.

​

Risk

If the Directory Synchronization Accounts role is not excluded from Conditional Access policies requiring MFA or blocking access, the Entra Connect Sync Account will be unable to authenticate. This breaks hybrid identity synchronization between on-premises Active Directory and Entra ID, potentially causing authentication failures and identity inconsistencies.

​

Recommendation

Exclude the Directory Synchronization Accounts role from all Conditional Access policies that target all users and all cloud applications. This prevents breaking Entra Connect directory synchronization while maintaining security controls for interactive users.

​

Remediation

Dashboard steps

1. Navigate to the Microsoft Entra admin center at https://entra.microsoft.com.
2. Expand Protection > Conditional Access and select Policies.
3. Open each policy that targets All users and All cloud apps.
4. Under Users > Exclude, select Directory roles and add the Directory Synchronization Accounts role.
5. Save the policy.

​

References

• https://learn.microsoft.com/en-us/entra/identity/conditional-access/howto-conditional-access-policy-all-users-mfa
• https://learn.microsoft.com/en-us/entra/identity/hybrid/connect/reference-connect-accounts-permissions

​

Where this check fires

This check runs on every scheduled scan against your Microsoft 365 account. Findings appear at Cloud Security → Findings filterable by Check ID = entra_conditional_access_policy_directory_sync_account_excluded. To re-evaluate after a fix, hit Run now on the account’s schedule under Cloud Security → Schedules — the next scan re-checks this control and marks the finding fixed or keeps it persistent.

---

← Back to Microsoft 365 checks