Description:
Verifies that tenant has no hybrid Global Administrator accounts.
Why:
By provisioning cloud-only Microsoft Entra ID user accounts to privileged users, the risks associated with a compromise of on-premises federation infrastructure are reduced. It is more challenging for the adversary to pivot from the compromised environment to the cloud with privileged access.
Configured: Tenant has no hybrid Global Administrator accounts.
Not Configured: Tenant has hybrid Global Administrator accounts.
Scoring: Contributes up to 1 point to the Posture Recommendations score.
Category: Identity
Microsoft Licensing: Works with Basic licensing
Remediation in Augmentt: No in-product remediation — remediate in the Microsoft admin portals.
Compliance Frameworks:
CISA SCuBA — MS.AAD.7.3
CIS Microsoft 365 Benchmark v6 (Level 1) — 1.1.1
CIS Microsoft 365 Benchmark v7 (Level 1) — 1.1.1
CMMC Level 2 — AC.L2-3.1.5
Microsoft documentation: