ASD ISM 1952 Prevent synchronisation of privileged accounts
What it says
Privileged user accounts are not synchronised between Microsoft AD DS and Microsoft Entra ID.
Quoted as published. Everything else on this page is written by Control Stack.
What it means
In plain EnglishEnsure privileged accounts aren't synced between Microsoft AD DS and Entra ID for security reasons.
This control means you should not let accounts with special access or powers be automatically copied between your local computer systems and Microsoft's cloud systems. Doing so is important because if someone gains unauthorised access to these powerful accounts, they could cause significant harm by accessing sensitive information or disrupting operations.
Free. Save your status, tasks and notes.
Why it matters
Unauthorised sync of privileged accounts between AD DS and Entra ID could lead to compromised credentials and elevated risks of data breaches or operational disruptions.
How to implement
The IT team should identify which user accounts have special privileges.
Do this by reviewing all user accounts in the local Microsoft Active Directory to see which ones have administrator access or other special roles.
The IT manager should ensure that these privileged accounts are not set to synchronise with the Microsoft Entra ID.
This can be achieved by configuring the synchronisation settings to exclude these accounts.
System administrators should create a policy to regularly review the list of privileged accounts.
Set a schedule for these reviews, such as quarterly, and document any changes or updates.
The IT team should provide training to staff on the importance of this control.
They can organise a workshop or briefing session to explain the risks involved with syncing privileged accounts.
Managers should perform regular checks to ensure this control is being followed.
This can be done by reviewing synchronisation logs from the Entra Connect tool to verify they exclude privileged accounts.
Keep it running
Regularly audit account sync configurations to ensure privileged accounts remain unsynced, protecting against potential security cross-contamination.
Evidence and audit
- Check 1 of 5What an auditor asks for
Ask for
The list of all privileged user accounts: Request this list from the IT team to ensure there is a clear understanding of who has special access.
Look at
Account names and roles to verify that they align with organisational needs.
Good evidence
Is a clearly defined and current list of privileged accounts.
- Check 2 of 5What an auditor asks for
Ask for
Synchronisation settings documentation: Request documentation showing how the synchronisation between AD DS and Entra ID is configured.
Look at
The settings to ensure privileged accounts are excluded.
Good evidence
Shows specific configurations that prevent the synchronisation of privileged accounts.
- Check 3 of 5What an auditor asks for
Ask for
To see recent synchronisation logs: These logs should be available from the Entra Connect tool.
Look at
Evidence that privileged accounts are not listed in the synchronisation activity.
Good evidence
Is logs that only show non-privileged accounts are being synced.
- Check 4 of 5What an auditor asks for
Ask for
The policy on privileged account management: Request the written policy document regarding the management of privileged accounts. Look to confirm there are clear steps for managing and reviewing these accounts.
Good evidence
Is a detailed, current policy that addresses the exclusion from syncing.
- Check 5 of 5What an auditor asks for
Ask for
Records of training sessions: Request evidence that staff received training regarding the importance and operation of this control.
Look at
Attendance records or materials used in training sessions.
Good evidence
Is documentation showing who attended and the content covered.
Mappings
Closest match in ISO/IEC 27001: A.8.2, Management of privileged access rights, which this control partially meets.
ISO/IEC 27001: 1 mapping
This control partially meets A.8.2.
ISM-1952 requires that privileged user accounts are not synchronised between Microsoft AD DS and Microsoft Entra ID to reduce the risk of cloud compromise leading to on-premises privileged access (and vice versa). ISO/IEC 27001:2022 Annex A 8.2 requires privileged access rights to be restricted and managed across the organisation, which can include controlling how privileged identities are provisioned and where they exist. ISM-1952 is a specific technical identity-architecture constraint that sits under the broader governance and management expectations of Annex A 8.2.
Mappings show how controls relate across frameworks. They do not imply full equivalence or certification.