Skip to main content
Version: 2.1.0

MT.1020 - All Conditional Access policies are configured to exclude directory synchronization accounts or do not scope them.

Overview​

The directory synchronization accounts are used to synchronize the on-premises directory with Entra ID. These accounts should be excluded from all conditional access policies scoped to all cloud apps and all users. Entra ID connect does not support multifactor authentication. Restrict access with these accounts to trusted networks.

Test Metadata​

FieldValue
Test IDMT.1020
SeverityHigh
SuiteMaester
CategoryCA
PowerShell testTest-MtCaExclusionForDirectorySyncAccount
TagsCA, Maester, MT.1020

Source​

  • Pester test: tests/Maester/Entra/Test-ConditionalAccessBaseline.Tests.ps1
  • PowerShell source: powershell/public/maester/entra/Test-MtCaExclusionForDirectorySyncAccount.ps1