SyncJacking: Secure Your Hybrid Identity Before March 2026

1graph LR
2    A[AD On-Premises] -->|Sync| B[Entra Connect]
3    B -->|Hard-Match| C[Entra ID]
4    D[Privileged Cloud Account] -.->|Overwritten| C
5    E[Attacker] -->|Controls| A

1{
2  "error": {
3    "code": "HardMatchBlockedOnCloudOnlyAccount",
4    "message": "Hard-match attempt blocked on cloud-only privileged account",
5    "details": {
6      "targetObjectId": "guid",
7      "sourceAnchor": "base64",
8      "correlationId": "guid"
9    }
10  }
11}

1# Connection to required modules
2Connect-MgGraph -Scopes "User.Read.All", "Directory.Read.All"
3Import-Module ActiveDirectory
4 
5# Audit function for at-risk accounts
6function Test-SyncJackingVulnerability {
7    param(
8        [string]$DomainSuffix = "onmicrosoft.com"
9    )
10    
11    # 1. Retrieve all privileged cloud-only accounts
12    $privilegedRoles = @(
13        "62e90394-69f5-4237-9190-012177145e10", # Global Administrator
14        "e8611ab8-c189-46e8-94e1-60213ab1f814", # Privileged Role Administrator
15        "158c047a-c907-4556-b7ef-446551a6b5f7"  # Cloud Application Administrator
16    )
17    
18    $vulnerableAccounts = @()
19    
20    foreach ($roleId in $privilegedRoles) {
21        $roleMembers = Get-MgDirectoryRoleMember -DirectoryRoleId $roleId
22        
23        foreach ($member in $roleMembers) {
24            $user = Get-MgUser -UserId $member.Id -Property Id,UserPrincipalName,OnPremisesSyncEnabled,OnPremisesImmutableId,OnPremisesDistinguishedName
25            
26            # Check if it is a cloud-only account
27            if (-not $user.OnPremisesSyncEnabled -and $user.UserPrincipalName -like "*$DomainSuffix") {
28                $vulnerableAccounts += [PSCustomObject]@{
29                    UserPrincipalName = $user.UserPrincipalName
30                    ObjectId = $user.Id
31                    HasImmutableId = [bool]$user.OnPremisesImmutableId
32                    RiskLevel = if (-not $user.OnPremisesImmutableId) { "CRITICAL" } else { "MEDIUM" }
33                }
34            }
35        }
36    }
37    
38    # 2. Check for corresponding AD objects
39    foreach ($account in $vulnerableAccounts) {
40        $upn = $account.UserPrincipalName
41        $adUser = Get-ADUser -Filter "UserPrincipalName -eq '$upn'" -ErrorAction SilentlyContinue
42        
43        if ($adUser) {
44            $account | Add-Member -NotePropertyName "ADObjectFound" -NotePropertyValue $true
45            $account.RiskLevel = "CRITICAL - IMMEDIATE ACTION REQUIRED"
46        }
47    }
48    
49    return $vulnerableAccounts
50}
51 
52# Execute audit
53$results = Test-SyncJackingVulnerability
54$results | Format-Table -AutoSize

1# Graph query to identify accounts without OnPremisesObjectIdentifier
2$uri = "https://graph.microsoft.com/v1.0/users?`$filter=accountEnabled eq true and onPremisesSyncEnabled ne true&`$select=id,userPrincipalName,onPremisesImmutableId,createdDateTime&`$top=999"
3 
4$headers = @{
5    Authorization = "Bearer $accessToken"
6}
7 
8$response = Invoke-RestMethod -Uri $uri -Headers $headers -Method Get
9$cloudOnlyUsers = $response.value | Where-Object { -not $_.onPremisesImmutableId }

1# Search in synchronization logs
2$syncLogs = Get-EventLog -LogName "Application" -Source "Directory Synchronization" -After (Get-Date).AddDays(-7)
3$hardMatchEvents = $syncLogs | Where-Object { $_.Message -match "hard.*match|immutableid.*conflict" }

1# Configure connector with certificate
2$cert = New-SelfSignedCertificate -Subject "CN=EntraConnectSync" -CertStoreLocation "Cert:\LocalMachine\My" -KeyExportPolicy Exportable -KeySpec Signature -KeyLength 2048 -HashAlgorithm SHA256
3 
4# Export and configuration
5$certPassword = ConvertTo-SecureString -String "ComplexP@ssw0rd!" -Force -AsPlainText
6Export-PfxCertificate -Cert $cert -FilePath "C:\EntraConnect\sync-cert.pfx" -Password $certPassword

1# Correct exclusion
2Set-ADSyncSchedulerConnectorOverride -ConnectorIdentifier $connectorId -FullImportRequired $true -FullSyncRequired $true
3Add-ADSyncAADCompanyFeature -ForcePasswordSync $false -ForceUserPrincipalNameSync $false

1# Automated monitoring script
2$webhook = "https://outlook.office.com/webhook/..."
3$errors = Get-ADSyncRunStepResult -RunHistoryId (Get-ADSyncRunProfileResult)[0].RunHistoryId | Where-Object {$_.StepResult -ne "Success"}
4 
5if ($errors) {
6    Invoke-RestMethod -Uri $webhook -Method Post -Body ($errors | ConvertTo-Json)
7}

1# Validate sourceAnchor
2$connector = Get-ADSyncConnector | Where-Object {$_.Type -eq "AD"}
3if ($connector.Parameters['UserSourceAnchor'] -ne 'ms-DS-ConsistencyGuid') {
4    Write-Error "Unsecured sourceAnchor configuration detected"
5}

1# Audit permissions
2$syncAccount = "MSOL_[identifier]"
3$permissions = Get-ACL "AD:\CN=Users,DC=contoso,DC=com" | Select-Object -ExpandProperty Access | Where-Object {$_.IdentityReference -match $syncAccount}

1// Log Analytics configuration for Entra Connect
2resource workspace 'Microsoft.OperationalInsights/workspaces@2021-12-01-preview' = {
3  name: 'EntraConnectMonitoring'
4  location: resourceGroup().location
5  properties: {
6    retentionInDays: 90
7    features: {
8      enableLogAccessUsingOnlyResourcePermissions: true
9    }
10  }
11}

1# GitHub repository with remediation scripts
2# git clone https://github.com/Microsoft/EntraConnectSecurity