Contact Us
Support
Partners
Downloads
Cayosoft®
Trials & Tools
Book a Demo
CTD-000011

Microsoft Entra cloud-only user with immutable ID set

High
Entra ID
Persistence
v53

Signature Identity

CTD-000011
Threat ID
53
Version
IOA-IOC-IOE
Indicator Type

Threat Description

A Microsoft Entra cloud-only user with an immutable ID set might be an indication of threat activities. A threat actor can create a backdoor in the Microsoft Entra tenant via federation configuration modification. When you federate your on-premises environment with Microsoft Entra ID, you establish a trust relationship between the on-premises identity provider and Microsoft Entra ID. Due to this established trust, Microsoft Entra ID honors the security token issued by the on-premises identity provider post authentication, to grant access to resources protected by Microsoft Entra ID.

MITRE ATT&CK: Attack Tactics

Persistence

D3FEND: Defend Tactics

Domain Account Monitoring

Remediation

  1. Review all federated domains within Microsoft Entra ID and its federation settings:
    1. Check that there are no unknown domains or unknown Issuer URL.
    2. In Cayosoft Guardian, navigate to Microsoft 365 > {your tenant} > Domains.
    3. In Microsoft Entra admin center, navigate to Custom domain names.
    4. In PowerShell, use Microsoft Graph PowerShell to check federation settings for your domains. Run the following commands:
      1. Connect-MgGraph -Scopes "Domain.Read.All"
      2. Get-MgDomain
      3. Get-MgDomainFederationConfiguration -DomainId "<your domain>"
    5. To prevent false-positive threat alerts, add your domains to the Federated domains white list on the Threat Detection Rule properties screen.
  2. Check that there are no suspicious changes in the federated domain’s configuration:
    1. In Cayosoft Guardian, navigate to Change Monitoring > Change History.
    2. In Microsoft Entra admin center, navigate to Audit logs and check the “Monitor changes to federation configuration in your Microsoft Entra ID” article.
  3. If the target user account is no longer required, cleanup the target user account:
    1. Disable this account.
    2. Clear the Immutable ID on the target user account.
    3. Automation: Select an automated remediation action to let Cayosoft Guardian perform these remediation steps.
  4. Review target user account for suspicious activity:
    1. In Microsoft Entra admin center, review target user sign-in logs and user activity in Audit logs.
    2. In Microsoft 365 Defender Portal, review user activity in Audit log.

Frequently Asked Questions

What does Microsoft Entra cloud-only user with immutable ID set mean?

In a Microsoft Entra tenant, a cloud-only user with an immutable ID is a type of user account that has had its identifier (ID) set as immutable. This means the ID cannot be changed or deleted.

This configuration allows attackers to bypass normal authentication and authorization controls, enabling them to gain direct access to sensitive data and systems. The unchanged ID can be exploited by attackers to authenticate and authorize access to resources protected by Microsoft Entra ID.

Attackers exploit the unchanged ID to authenticate and authorize access to resources, bypassing normal security controls. This allows them to gain unauthorized access to sensitive data and systems.

Cayosoft Guardian continuously monitors the settings of user accounts in the Microsoft Entra tenant, including the immutable ID setting. When it detects a user account with an immutable ID set, Guardian flags it as a security issue and alerts administrators to review and investigate.

Cayosoft Guardian provides visibility into potential security issues, including a Microsoft Entra cloud-only user with an immutable ID set. This allows administrators to review and remediate the issue promptly, reducing the likelihood of unauthorized access.

Stop AD Threats As They Happen

Cayosoft Protector provides continuous monitoring and real-time alerts across your entire Microsoft Identity stack

Free Forever
Classification
Systems
Entra ID
Themes
Account protection
Attack Tactics
Persistence
Defend Tactics
Domain Account Monitoring
Indicator Types
IOA IOC IOE
Related Threats
CTD-000139
Kerberos Constrained Delegation: krbtgt Risks
Critical
CTD-000122
Active Directory Schema Update Permission Risks
Critical