Your Entra Connect server is a domain controller in disguise
The Entra Connect server links your Active Directory to Entra ID. It holds rights that allow extracting every password hash in the domain, and yet it is often administered like any other server.
A server straddling two worlds
In a hybrid environment, Microsoft Entra Connect synchronizes Active Directory accounts to Entra ID. The server hosting it is often treated as an ordinary application server: run by the systems team, backed up with the rest, monitored by the same tools. That is a classification error with heavy consequences.
Why it is Tier 0
With password hash synchronization, the service account Entra Connect uses in the directory (the MSOL_… account of an express installation) holds the directory replication rights — the same rights a DCSync attack exploits. Anyone who administers this server can recover those credentials and extract the password hashes of the entire domain.
In the other direction, the sync account on the Entra ID side can modify synchronized objects in the cloud. The Entra Connect server therefore links the on-premises control plane and the cloud control plane: compromising it opens both.
Other components to watch
- Pass-through authentication (PTA): its agents validate passwords against AD. A compromised agent can accept any password or intercept the ones passing through.
- Seamless single sign-on relies on the
AZUREADSSOACCcomputer account. Its Kerberos decryption key should be rolled over regularly — Microsoft recommends at least every 30 days; in many environments it has never been rolled since installation. - ADFS, where it remains: its token-signing key can be used to forge authentications to Microsoft 365.
The question to ask. Who is a local administrator of the Entra Connect server today? The answer often includes the helpdesk group, a monitoring account and the software deployment tool — each one a path to the domain.
Harden it like a domain controller
- Restrict administration to Tier 0 accounts, from dedicated admin workstations.
- Remove agents and tools not administered at Tier 0 level: monitoring, deployment, shared consoles.
- Keep Entra Connect up to date: old versions go out of support and eventually stop synchronizing.
- Protect the server's backups like those of a domain controller.
- Roll over the
AZUREADSSOACCkey and document the procedure. - Log and monitor sign-ins to the server and changes to the sync configuration.
If hybrid is no longer essential, a move to the lighter Cloud Sync, or a gradual exit from synchronization, is worth considering. The safest component is still the one you no longer need.