Use dedicated, named, cloud-only accounts for administrative roles

Description

Every account that holds a privileged Microsoft Entra role (active or eligible, directly or through a group) is:

• cloud-only: created in Microsoft Entra ID, not synchronized from Active Directory and not federated with another identity provider (onPremisesSyncEnabled is empty or false);
• dedicated: used only for administration, separate from the person's everyday account that reads mail, browses and works on documents;
• named: assigned to one identified person, never shared between several administrators.

The emergency access accounts (CB-M365-ADMIN-002) are the only non-named exception.

Naming conventions (for example an adm- prefix) help reviewers, but only the account owner registry proves that an account is named and dedicated. The license footprint of admin accounts is covered by CB-M365-ADMIN-005.

Rationale

A synchronized account inherits the trust of Active Directory: whoever controls a domain controller or the Entra Connect server can reset its password or take it over, and pivot from the on-premises network to the whole tenant. A federated account depends on the security of the external identity provider. An everyday account is exposed to phishing, malicious attachments and browser exploits all day long; separating the admin account keeps those threats away from the privileges. Named accounts make every privileged action traceable to a person.

Impact

Each administrator manages a second account and a second set of authentication methods. Scripts or service desks that rely on synchronized admin accounts must be moved to the cloud-only ones. Administrators whose on-premises role required the same account keep a separate account in Active Directory.

Audit

1. Sign in to the Microsoft Entra admin center (https://entra.microsoft.com) as at least a Global Reader.
2. Browse to Entra ID > Roles & admins > Roles & admins. For each role marked Privileged, open Assignments and list the active and eligible members; expand groups.
3. For each account, open the user and check Properties > On-premises > On-premises sync enabled: it must be No (or empty).
4. Check against the administrator registry that each account belongs to one person and is not that person's everyday account (no mailbox use, no Teams activity, see CB-M365-ADMIN-005).
5. Read-only PowerShell alternative (Microsoft Graph, scope RoleManagement.Read.Directory, User.Read.All):

   Get-MgRoleManagementDirectoryRoleAssignment -All -ExpandProperty Principal |
     ForEach-Object { Get-MgUser -UserId $_.PrincipalId -Property UserPrincipalName,OnPremisesSyncEnabled -ErrorAction SilentlyContinue } |
     Where-Object OnPremisesSyncEnabled | Select-Object UserPrincipalName
   

   Repeat with Get-MgRoleManagementDirectoryRoleEligibilitySchedule for eligible assignments.
6. Fail if any privileged role holder is synchronized from on-premises, is shared, or is the everyday account of its owner.

Remediation

1. For each administrator in breach, create a cloud-only account (user principal name on a managed domain or on *.onmicrosoft.com) with at least the User Administrator role (Privileged Authentication Administrator is needed to reset methods of other admins).
2. Have the owner register phishing-resistant methods on the new account (CB-M365-AUTH-004).
3. Assign the roles to the new account, preferably as eligible through Privileged Identity Management (CB-M365-ADMIN-006), with at least the Privileged Role Administrator role.
4. Remove the roles from the synchronized, shared or everyday account.
5. Replace any shared admin account with named accounts, then disable and delete it.

Rollback

Reassign the roles to the previous account from Roles & admins with a Privileged Role Administrator or an emergency access account.

References

• Best practices for Microsoft Entra roles Microsoft, vendor-doc, accessed 2026-10-24
• Securing privileged access for hybrid and cloud deployments in Microsoft Entra ID Microsoft, vendor-doc, accessed 2026-10-24
• CISA SCuBA Microsoft Entra ID baseline CISA, standard, accessed 2026-10-24

Mappings

How this control relates to the other framework's: equivalent, stricter, looser, partial or related.

Threats mitigated

Related controls

• related CB-M365-ADMIN-005 License administrator accounts without mailbox or collaboration apps
• related CB-M365-ADMIN-012 Do not assign privileged roles to guest users
• related CB-M365-ADMIN-006 Grant highly privileged roles just in time through Privileged Identity Management
• related CB-M365-AUTH-045 Harden directory synchronization against cloud account takeover from Active Directory
• related CB-M365-AUTH-004 Require phishing-resistant MFA for administrative roles

People and lifecycle