ASD ISM 1949 Use dedicated accounts for AD FS administration
What it says
Microsoft AD FS servers are administered using a dedicated service account that is not used to administer other systems.
Quoted as published. Everything else on this page is written by Control Stack.
What it means
In plain EnglishAD FS servers should be managed using special accounts not shared with other systems.
You should use special accounts just for managing AD FS servers, instead of using the same accounts for other systems. This is important because if a hacker gains access to a shared account, they could control not just the AD FS server, but other systems too, leading to a wide-scale security breach.
Free. Save your status, tasks and notes.
Why it matters
Without dedicated AD FS admin accounts, a breach can escalate to other critical systems, increasing the risk of widespread compromise.
How to implement
IT team should create dedicated accounts: Set up special user accounts specifically for AD FS administration to avoid using any existing accounts that might have other permissions.
Make sure these accounts are used only for AD FS tasks.
System owner to review user access: Regularly check who has access to the AD FS administration accounts to ensure only necessary personnel have access.
Set a schedule for quarterly reviews to keep track of any changes in the team.
HR department to inform IT of staff changes: Ensure HR notifies the IT team whenever there is a change in staff who manage AD FS so that access can be granted or revoked as soon as possible.
IT team should enable logging: Turn on logging for AD FS administration accounts to track who accesses the system and what changes are made.
Use these logs to detect any unusual behaviour quickly.
Managers to conduct training: Organise training sessions for staff who use AD FS administration accounts to ensure they understand the importance of using these accounts correctly and securely.
Keep it running
Use a dedicated AD FS admin account only on AD FS servers; audit group membership and logons for cross-use regularly.
Evidence and audit
- Check 1 of 5What an auditor asks for
Ask for
The list of dedicated AD FS accounts: Request the document that lists all special accounts used for AD FS administration.
Look at
The account names and purposes.
Good evidence
List will show only accounts used for AD FS and nothing else.
- Check 2 of 5What an auditor asks for
Ask for
The access review records: Request records of the regular access reviews for AD FS accounts.
Look at
The dates and findings.
Good evidence
Record shows these reviews happen quarterly, and all access is justified.
- Check 3 of 5What an auditor asks for
Ask for
The staff access change log: Request the log of any changes to who can use AD FS administration accounts.
Look at
Details like date of change and reason.
Good evidence
Change log shows timely updates in line with staff changes.
- Check 4 of 5What an auditor asks for
Ask for
Usage logs: Request the logs of when and how AD FS administration accounts are used.
Look at
Any unusual times or access patterns.
Good evidence
Log shows regular, expected activity and no suspicious behaviour.
- Check 5 of 5What an auditor asks for
Ask for
Training materials: Request the materials used for training staff on AD FS account usage.
Look at
Content on security best practices and proper usage protocols. Good materials clearly cover the importance of using dedicated accounts for AD FS.
Mappings
Closest match in ISO/IEC 27001: A.8.2, Management of privileged access rights, which this control partially meets.
ISO/IEC 27001: 1 mapping
This control partially meets A.8.2.
ISM-1949 mandates dedicated, non-reused accounts for administering AD FS servers to control and segregate privileged access. Annex A 8.2 requires privileged access rights to be restricted and managed more generally across the organisation. ISM-1949 is a technology-specific, concrete control that fits within the broader privileged access management expectations of Annex A 8.2.
ASD Essential Eight: 2 mappings
This control partially meets E8-RA-ML1.2.
ISM-1949 requires Microsoft AD FS servers to be administered using a dedicated service account that is not used to administer other systems. E8-RA-ML1.2 similarly requires privileged users to have dedicated privileged accounts used solely for privileged duties, aligning with the dedicated-account principle. ISM-1949 is a specific application for AD FS administration and emphasises non-reuse across other systems, while E8-RA-ML1.2 is broader across all privileged administration.
This control partially overlaps E8-RA-ML2.5.
ISM-1949 requires AD FS administration to occur via a dedicated account that is not used to administer other systems. E8-RA-ML2.5 relates by requiring strong, unique, managed credentials for service and administrator accounts, which strengthens the security of any dedicated AD FS admin/service account. However, E8-RA-ML2.5 focuses on credential quality and management, whereas ISM-1949 focuses on account separation and non-reuse for AD FS administration.
Mappings show how controls relate across frameworks. They do not imply full equivalence or certification.