MT.1081: Hybrid users should not be assigned Entra ID role assignments.

ID	MT.1081
Severity	Medium
Suite	Mito
Product	Defender
Related products	Entra ID
Feature	Exposure Management
Security area	Privileged access
Resource type	User
User impact of fixing	Low
Effort to fix	Medium
Framework controls	nist-800-53-r5:AC-6(5) Least Privilege | Privileged Accounts
MITRE ATT&CK	T1078.002, T1078.004, T1556.007
Reads from	Microsoft Graph

What this checks and how to fix it

Microsoft strongly recommends avoiding the use of synchronized identities to manage Microsoft 365 or Microsoft Entra environments for protecting against on-premises attacks.

How to fix

Create dedicated privileged users to assign and use Entra ID roles, and remove the previous role assignments for the on-premises accounts.

---

Mito check. Author: Cloud-Architekt. Open-source licences.