Skip to content
System hardening
ASD ISMISM-1950

ASD ISM 1950 Disable soft matching after synchronisation

What it says

Soft matching between Microsoft AD DS and Microsoft Entra ID is disabled following initial synchronisation activities.

Quoted as published. Everything else on this page is written by Control Stack.

What it means

In plain English

Ensure soft matching is turned off after syncing Microsoft AD DS with Microsoft Entra ID to enhance security.

After you sync your local Microsoft Active Directory (AD DS) with Microsoft's cloud service, Microsoft Entra ID, you should switch off something called 'soft matching'. This matters because leaving it on could accidentally link the wrong user accounts together, which might give someone access to things they shouldn't see.

Why it matters

If soft matching remains enabled after initial sync, AD DS and Entra ID accounts may link incorrectly, enabling unauthorised access to data and services.

How to implement

  1. The IT team should confirm that soft matching is disabled in Microsoft Entra Connect settings after syncing.

    They can do this by logging into the Microsoft Entra Connect admin interface, navigating to the synchronisation settings, and ensuring that soft matching is turned off.

  2. The IT manager should schedule a review meeting one week after initial synchronisation to verify settings.

    During the meeting, they should ask the IT team for a demonstration that soft matching was properly turned off post-sync.

  3. A system administrator should document the procedure of disabling soft matching and include step-by-step screenshots.

    This can be useful for training purposes and as evidence that the control was implemented correctly.

  4. The compliance officer should ensure all IT staff are aware of the risks associated with soft matching.

    They can organise a training session where the consequences of improper account linking are clearly explained through examples.

  5. Procurement should verify that any external IT support used is aware of this control and includes it in their service agreement.

    When hiring, they should ask potential vendors about their experience with Microsoft Entra Connect and managing synchronisation settings.

Keep it running

After initial synchronisation, confirm soft matching is disabled in Entra Connect/AAD Connect settings and periodically re-check to prevent unintended AD DS-Entra ID account linking.

Evidence and audit

  1. Check 1 of 5What an auditor asks for

    Ask for

    The Microsoft Entra Connect configuration documentation: Request the official procedure document that details the settings used during AD synchronisation.

    Look at

    A specific section on soft matching settings.

    Good evidence

    The document clearly states that soft matching is turned off and provides a rationale for this setting.

  2. Check 2 of 5What an auditor asks for

    Ask for

    To see the synchronisation settings in the Microsoft Entra Connect console: Request a live demonstration or screenshots of the current settings.

    Look at

    Screenshots or a demo showing soft matching is set to 'off'.

    Good evidence

    Evidence from the IT system showing the off position for soft matching, properly documented and timestamped.

  3. Check 3 of 5What an auditor asks for

    Ask for

    Change management records related to initial sync: Request logs or records that show when soft matching was disabled.

    Look at

    Timestamped entries that align with initial sync.

    Good evidence

    Logs indicate that soft matching was switched off immediately following initial AD sync.

  4. Check 4 of 5What an auditor asks for

    Ask for

    IT training materials on Microsoft Entra Connect: Request slides or training guides provided to IT staff.

    Look at

    Clear explanations about why and how soft matching should be turned off.

    Good evidence

    Training materials with a section dedicated to this control, including risks and steps taken.

  5. Check 5 of 5What an auditor asks for

    Ask for

    IT staff acknowledgements of understanding the control: Request signed documents or digital confirmations from IT staff indicating their understanding of disabling soft matching.

    Look at

    Signatures or digital acknowledgements with dates.

    Good evidence

    Each relevant IT staff member has confirmed understanding via a signed document.

Mappings

Closest match in ISO/IEC 27001: A.5.16, Identity life cycle management, which this control partially meets.

ISO 27001

ISO/IEC 27001: 1 mapping

  • A.5.16Identity life cycle managementPartially meets

Mappings show how controls relate across frameworks. They do not imply full equivalence or certification.