What is the sense of MT.1020 to exclude all synched accounts from CA?

[blindzero]

Hi there,

we have a hybrid environment, so on-prem AD is our first source of account truth.
As we protect our users by Conditional Access policies the test MT.1020: All Conditional Access policies are configured to exclude Directory/OnPremises synchronization accounts or do not scope them. is failing in our environment.

Looking at it I honestly couldn't find any reason why this is a test at all, because it is even contra-productive. I also couldn't find any official recommendation on excluding synched users always from CA policies?

Why is this test existing at all. Should it be decommed?

Best,
Matthias

[SamErde]

Good question! This doesn't exclude synchronized users--it excludes the identity(s) of the synchronization accounts that are used by Entra ID Connect itself.

[blindzero]

Hi @SamErde ,
ooh 🤦 ... ok, reading it properly is definetly beneficial.
However, I read in https://maester.dev/docs/tests/MT.1020/ the reasoning is

[...] Entra ID connect does not support multifactor authentication. [...]

Am I wrong or is that outdated with the latest updates on Entra ID Connect and supporting now modern authentication?
Would this be maybe a reason to decommission the MT.1020 test?

Best,
Matthias

[SamErde]

That's a good catch! It does support MFA now! Would you like to submit a PR with an update around that documentation? Your attention to detail is excellent.

EDIT: Just to be clear, I believe the exclusion for those directory synchronization accounts may still be best practice. At least, I haven't seen any documentation that states they should no longer be excluded.

[blindzero]

Hi @SamErde,
sure, my pleasure to help. Would do PR, if you think it is applicable. I agree that it is somehow still practice, in particular if not updated, yet. However, I think there is a deadline for the new versions to be rolled out by hybrid environments somewhen now anyways. Then this recommendation does not really make sense, does it? Because of recommendation to use modern auth here?
If you agree, I am happy to submit a PR.

[SamErde]

For now, it would be good to update Maester's documentation so it correctly states the current functionality of Entra Connect (or Entra Cloud Sync where applicable). Entra Connect won't be completely replaced in 100% of environments for some time yet. I would be surprised if that takes anything less than 18 - 24 months to fully migrate and retire.

[blindzero]

opened #2112 and send PR soon