SyncJacking Prevention: PowerShell to the Rescue

Imagine this: you're sipping coffee on a calm Monday morning when suddenly Microsoft's new directive hits your inbox. Now you're scrambling to ensure no rogue AD writer hijacks your precious Entra roles. Don't panic—grab your PowerShell cape, and let's save your directory from impending doom.

Microsoft is tightening hybrid identity practices—and for a good reason. SyncJacking is a potential attack where an adversary with Active Directory write access could craft an on-premises user object that hard-matches to a privileged cloud account through Entra Connect synchronization.

In plain English: an attacker who can create or modify AD user objects could inject their account into your cloud directory, hijacking a privileged Entra account faster than you can say "Zero Trust." Not so funny when your Global Admin account suddenly starts offering free crypto on LinkedIn.

Before June 1 rolls around, you need to answer one critical question: do any of your Entra role holders have an onPremisesImmutableId set?

If they do, those accounts are synced from (or have been matched to) on-premises AD. That's exactly the scenario Microsoft is locking down. You need to audit both:

• Permanently assigned roles — Users with always-on directory role assignments.
• PIM-eligible roles — Users who can activate privileged roles through Privileged Identity Management.

Let's tackle the straightforward case first—accounts with permanently assigned Entra directory roles:

# Connect to Microsoft Graph API (delegated / interactive)
Connect-MgGraph -Scopes "Directory.Read.All", "RoleManagement.Read.Directory"

# Query all permanent role assignments and check for synced accounts
Get-MgRoleManagementDirectoryRoleAssignment -All | ForEach-Object {
    $user = Get-MgUser -UserId $_.PrincipalId `
        -Property "displayName,userPrincipalName,onPremisesImmutableId,onPremisesSyncEnabled" `
        -ErrorAction SilentlyContinue

    if ($user -and $user.onPremisesImmutableId) {
        [PSCustomObject]@{
            Name        = $user.displayName
            UPN         = $user.userPrincipalName
            ImmutableId = $user.onPremisesImmutableId
            SyncEnabled = $user.onPremisesSyncEnabled
        }
    }
} | Format-Table -AutoSize

Because why settle for 70% safety when you can have 100%? PIM-eligible roles are the gap most admins miss. If someone can activate Global Admin through PIM, they're just as much a SyncJacking target.

# Connect to Microsoft Graph API with PIM eligibility scopes
Connect-MgGraph -Scopes "RoleEligibilitySchedule.Read.Directory", "Directory.Read.All"

# Query all PIM-eligible role schedules (users who CAN activate a role)
$schedules = Get-MgRoleManagementDirectoryRoleEligibilitySchedule -All

$results = foreach ($schedule in $schedules) {
    $user = Get-MgUser -UserId $schedule.PrincipalId `
        -Property "displayName,userPrincipalName,onPremisesImmutableId,onPremisesSyncEnabled" `
        -ErrorAction SilentlyContinue

    if ($user -and $user.onPremisesImmutableId) {
        [PSCustomObject]@{
            Name        = $user.displayName
            UPN         = $user.userPrincipalName
            ImmutableId = $user.onPremisesImmutableId
            Role        = $schedule.RoleDefinitionId
            SyncEnabled = $user.onPremisesSyncEnabled
        }
    }
}

# Display in console
$results | Format-Table -AutoSize

# Export to CSV for audit trail
$results | Export-Csv -Path "PIM_Affected_Users.csv" -NoTypeInformation

# Fetch all role definitions for name lookup
$roleDefs = Get-MgRoleManagementDirectoryRoleDefinition -All

# Then in your output, replace:
#   Role = $schedule.RoleDefinitionId
# With:
#   Role = ($roleDefs | Where-Object { $_.Id -eq $schedule.RoleDefinitionId }).DisplayName

Remediation Options

• Convert to cloud-only: If the account doesn't need to sync, remove the onPremisesImmutableId by moving it out of sync scope and converting it to a cloud-only account.
• Remove the Entra role: If the account is legitimately synced and doesn't need the privileged role, remove the role assignment.
• Use a dedicated cloud-only admin account: Best practice is to have privileged Entra roles assigned to cloud-only accounts, separate from synced identities.
• Review PIM eligibility: Ensure PIM-eligible users are intentional and documented. Remove stale eligibility assignments.

By running both scripts, you're not just protecting your Active Directory—you're ensuring no sync-enabled supervillain can hijack your infrastructure. Do it for your users. Do it for the compliance team. Do it for lunch breaks uninterrupted by a SOC email titled "Privileged Account Anomaly."