Forum Discussion
Best Practive for Admin Accounts with ADFS / AAD - OnPremise ones or Cloud based
ErikVet The environments I have worked in, administrator accounts have tended to be synced accounts, the point about lateral movement is a good one though. There is nothing that a synced account can't do that a cloud account for admin and visa versa in a practical matter.
This is a really good article on creating a resilient access control management strategy with Azure AD. This is more if you start implementing Conditional Access and avoiding user or admin lockout with a set of recommendations. It does include emergency access break glass accounts, outlined in its own article, as you alluded to here is Microsoft's recommendation:
"Create two or more emergency access accounts. These accounts should be cloud-only accounts that use the *.onmicrosoft.com domain and that are not federated or synchronized from an on-premises environment."
Plenty more general best practices and here that you may have seen already. This is Microsoft's advice for Office 365 and setting up dedicated admin accounts only to be used when global administrator access is required and using other administration roles for user accounts.
ErikVet The environments I have worked in, administrator accounts have tended to be synced accounts, the point about lateral movement is a good one though. There is nothing that a synced account can't do that a cloud account for admin and visa versa in a practical matter.
This is a really good article on creating a resilient access control management strategy with Azure AD. This is more if you start implementing Conditional Access and avoiding user or admin lockout with a set of recommendations. It does include emergency access break glass accounts, outlined in its own article, as you alluded to here is Microsoft's recommendation:
"Create two or more emergency access accounts. These accounts should be cloud-only accounts that use the *.onmicrosoft.com domain and that are not federated or synchronized from an on-premises environment."
Plenty more general best practices and here that you may have seen already. This is Microsoft's advice for Office 365 and setting up dedicated admin accounts only to be used when global administrator access is required and using other administration roles for user accounts.
Just have to make sure you also remove the cloud only account when someone quits. I would also make sure that Passeword Protection is applied to on-premises AD.
But so far I have not found anything that doesn’t work. It’s if you assign rights to resources to onpremises groups. You can’t add a cloud user to a onpremises group that is synced.