Feb 13 2020
- last edited on
Jan 14 2022
i just wanted to know from a technical standpoint if there are any disadvantages from using synced accounts (of course specials accounts) and asign them admin roles in the cloud or should you always choose cloud-only users for admin purposes. Yes I know there should be a cloud admin without MFA for "Just in case".
I'm asking this if we could run into any problems later in the whole MS cloud environment. e.g. for some tasks you need a cloud only user. For example I remember that for specific use cases you have to use Cloud Only Groups in the Dynamics area.
Is there any documentation around this ?
Are the any special
Feb 14 2020 12:07 AM
There isn't anything that a cloud only user can't do compared to a sync'ed user.
I recommend using cloud only admin accounts to avoid lateral movement though.
Feb 14 2020 02:05 AM - edited Feb 14 2020 02:07 AMSolution
@ErikVet The environments I have worked in, administrator accounts have tended to be synced accounts, the point about lateral movement is a good one though. There is nothing that a synced account can't do that a cloud account for admin and visa versa in a practical matter.
This is a really good article on creating a resilient access control management strategy with Azure AD. This is more if you start implementing Conditional Access and avoiding user or admin lockout with a set of recommendations. It does include emergency access break glass accounts, outlined in its own article, as you alluded to here is Microsoft's recommendation:
"Create two or more emergency access accounts. These accounts should be cloud-only accounts that use the *.onmicrosoft.com domain and that are not federated or synchronized from an on-premises environment."
Plenty more general best practices and here that you may have seen already. This is Microsoft's advice for Office 365 and setting up dedicated admin accounts only to be used when global administrator access is required and using other administration roles for user accounts.
Feb 14 2020 02:15 AM
Feb 16 2020 03:21 AM
@ErikVet Ok, so we are currently using cloud only adm accounts with
- Conditonal Access Policy
Azure MFA enforced
We have one emergency account.
We using PIM to asign adm roles on request.
Note: We would love to enforce hybrid joined clients as well, however this currently brakes browser based administration. It seems that in private mode / or incognito , device auth does not work and the cloud only account gets blocked...