Harden directory synchronization against cloud account takeover from Active Directory

Description

Directory synchronization is configured so that Active Directory cannot be used to take over cloud identities:

1. BlockSoftMatchEnabled is true: an on-premises object is never joined to an existing cloud account on its primary SMTP address or UPN. It is turned off only for the duration of a planned migration, then on again.
2. BlockCloudObjectTakeoverThroughHardMatchEnabled is true: a cloud-managed account cannot be taken over by an on-premises object with a matching immutable ID.
3. The temporary bypass allowOnPremUpdateOfOnPremisesObjectIdentifierEnabled is false.
4. The krbtgt_AzureAD account (Microsoft Entra Kerberos key object) is not in the synchronization scope.
5. The sync identity is protected: application-based authentication (Microsoft Entra Connect 2.5.76 or later), or, for a legacy user-based directory synchronization account, exclusion from user Conditional Access policies combined with a policy that restricts it to the sync servers' egress addresses. The sync servers are managed as Tier 0.

Since July 2026, Microsoft blocks hard matches on accounts that hold or are eligible for privileged roles, or already have an onPremisesObjectIdentifier; the bypass flag in point 3 removes that protection for the whole tenant. Cloud-only administrator accounts (CB-M365-ADMIN domain) remain the main defense.

Rationale

Soft and hard matching were designed for migrations, but they let whoever controls Active Directory (or the sync server) attach an object to a cloud-only account, including a Global Administrator, then push a known password through password hash synchronization. Synchronizing krbtgt_AzureAD exposes the key used to issue Kerberos tickets for cloud Kerberos trust. The sync account has broad write rights on the directory and is a known pivot from on-premises to cloud.

Impact

With soft matching blocked, new hybrid joined devices can fail with an InvalidSoftMatch error, and migrations that rely on SMTP or UPN matching need the block lifted temporarily. Moving to application-based authentication needs a Microsoft Entra Connect upgrade and a check with Get-ADSyncEntraConnectorCredential.

Applies when

Requires: Identities synchronized from Active Directory (Microsoft Entra Connect or Cloud Sync)

Audit

1. In PowerShell (Microsoft Graph, scope OnPremDirectorySynchronization.Read.All, role at least Global Reader): Get-MgDirectoryOnPremiseSynchronization | Select-Object -ExpandProperty Features | Format-List Check BlockSoftMatchEnabled : True, BlockCloudObjectTakeoverThroughHardMatchEnabled : True and, under AdditionalProperties, allowOnPremUpdateOfOnPremisesObjectIdentifierEnabled : False.
2. In the Microsoft Entra admin center (https://entra.microsoft.com), browse to Entra ID > Users, search for krbtgt_AzureAD and check that no synchronized user with that name exists (On-premises sync enabled = No or no result).
3. On each Microsoft Entra Connect server, run Get-ADSyncEntraConnectorCredential (read-only) and check that ConnectorIdentityType is Application. Otherwise, browse to Entra ID > Roles & admins > Directory Synchronization Accounts, note the user accounts, and check in Conditional Access that a policy restricts them to trusted locations.
4. Fail if soft or hard matching is not blocked, if the bypass flag is on, if krbtgt_AzureAD is synchronized, or if a user-based sync account is unrestricted.

Remediation

1. Block soft and hard matching (Microsoft Graph, scope OnPremDirectorySynchronization.ReadWrite.All, Hybrid Identity Administrator): $s = Get-MgDirectoryOnPremiseSynchronization; $s.Features.BlockSoftMatchEnabled = $true; $s.Features.BlockCloudObjectTakeoverThroughHardMatchEnabled = $true; Update-MgDirectoryOnPremiseSynchronization -OnPremisesDirectorySynchronizationId $s.Id -Features $s.Features
2. If the bypass flag is on and the remediation it was opened for is finished, set allowOnPremUpdateOfOnPremisesObjectIdentifierEnabled to false the same way.
3. Exclude krbtgt_AzureAD from synchronization: in the Microsoft Entra Connect wizard, filter out its OU or the object, or add a sync rule that excludes it; run a delta sync and delete the synchronized copy in Entra ID if one exists.
4. Upgrade Microsoft Entra Connect and switch the connector to application-based authentication; then remove the legacy directory synchronization account or its role.
5. Until then, restrict the user-based sync account with a Conditional Access policy that blocks it outside the sync servers' egress IP addresses.

Rollback

Set BlockSoftMatchEnabled to false only for the duration of a planned soft-match migration, and set it back to true afterwards.

References

• Microsoft Entra Connect Sync service features and configuration Microsoft, vendor-doc, accessed 2026-10-24
• Configure Microsoft Entra Connect for an existing tenant Microsoft, vendor-doc, accessed 2026-10-24
• Microsoft Entra Kerberos Microsoft, vendor-doc, accessed 2026-10-24
• Maester MT.1073 - Soft- and hard-matching of synchronized objects should be blocked Maester, tool, accessed 2026-10-24

Mappings

How this control relates to the other framework's: equivalent, stricter, looser, partial or related.

Threats mitigated

Related controls

• related CB-M365-AUTH-034 Keep Conditional Access policies free of broken references and unprotected exclusions
• related CB-M365-AUTH-044 Enable password hash synchronization for synchronized identities
• related CB-M365-ADMIN-001 Use dedicated, named, cloud-only accounts for administrative roles

People and lifecycle