ASD ISM 1951 Disable hard match takeover in Microsoft Entra Connect
What it says
Hard match takeover is disabled for Microsoft Entra Connect servers.
Quoted as published. Everything else on this page is written by Control Stack.
What it means
In plain EnglishEnsure that the hard match feature is turned off to prevent unauthorised access in Microsoft Entra Connect servers.
This control is about making sure a specific feature called hard match takeover in Microsoft Entra Connect is turned off. This is important because having it on could let someone gain control of user accounts without permission, putting your business data at risk.
Free. Save your status, tasks and notes.
Why it matters
If hard match takeover is enabled in Entra Connect, attackers can take over synced identities by matching on-premises accounts to cloud users.
How to implement
IT team should review Microsoft Entra Connect settings to ensure hard match takeover is disabled.
They can do this by logging into the Microsoft Entra admin portal and checking the synchronisation settings.
System owner should verify with the IT team that the hard match feature is turned off in all Microsoft Entra Connect instances.
This can be done through a report from the IT team that confirms this setting is off.
Office manager should organise a regular review schedule with the IT team to check the status of Microsoft Entra Connect settings.
This could be done quarterly and documented to ensure that the correct configurations remain in place.
Managers should ensure that staff responsible for managing Microsoft Entra Connect are properly trained.
Training sessions can be organised to cover the disabling of hard match takeover and understanding its implications.
Procurement or IT purchasing team should confirm that any third-party tools integrating with Microsoft Entra Connect have alignment with settings that keep hard match takeover disabled.
Research and discussions with vendors can help ensure compliance with this setting.
Keep it running
Periodically confirm the Entra Connect setting for hard match takeover remains disabled after upgrades, config changes or server rebuilds.
Evidence and audit
- Check 1 of 5What an auditor asks for
Ask for
A configuration report from Microsoft Entra Connect: Request a document showing current settings, especially for hard match takeover.
Look at
Whether hard match takeover is marked as disabled.
Good evidence
Is a report showing the feature is off with a recent audit date.
- Check 2 of 5What an auditor asks for
Ask for
Training records for staff responsible for Microsoft Entra Connect: Request documents that evidence relevant training sessions were attended.
Look at
The course content and attendance records.
Good evidence
Includes completed training sessions on the specific settings.
- Check 3 of 5What an auditor asks for
Ask for
An access log detailing recent changes to Microsoft Entra Connect settings: Request a log file or record of changes in the system.
Look at
Entries for who disabled the hard match takeover and when.
Good evidence
Would show a recorded action with a staff member's name and date.
- Check 4 of 5What an auditor asks for
Ask for
Regular review meeting minutes: Request documentation from scheduled IT review meetings discussing Microsoft Entra Connect settings.
Look at
Whether the disabling of hard match takeover was confirmed.
Good evidence
Would be meeting minutes that explicitly cover and confirm the setting.
- Check 5 of 5What an auditor asks for
Ask for
Vendor compliance reports for related tools: Request documents showing third-party tools' settings align with Microsoft Entra security practices.
Look at
Sections of the reports discussing integration settings about hard match takeover.
Good evidence
Confirms that vendors disable conflicting settings.
Mappings
Closest match in ISO/IEC 27001: A.5.16, Identity life cycle management, which this control partially meets.
ISO/IEC 27001: 2 mappings
This control partially meets A.5.16.
ISM-1951 requires that hard match takeover is disabled on Microsoft Entra Connect servers to prevent unauthorised account takeover via identity matching mechanisms. Annex A 5.16 (Identity life cycle management) relates because controlling how identities are created, linked, and managed across their lifecycle includes preventing unsafe account linking/takeover paths in synchronisation tooling. ISM-1951 is a specific technical safeguard in one product, while Annex A 5.16 is broader and covers end-to-end identity lifecycle processes across the organisation.
This control partially meets A.8.9.
ISM-1951 requires a specific security configuration: hard match takeover must be disabled on Microsoft Entra Connect servers. Annex A 8.9 (Configuration management) relates because it requires security configurations to be established, implemented, monitored and reviewed, which would include enforcing and validating the Entra Connect setting addressed by ISM-1951. ISM-1951 is a single-purpose configuration requirement, while Annex A 8.9 is a broad control covering configuration governance across hardware, software, services and networks.
Mappings show how controls relate across frameworks. They do not imply full equivalence or certification.