Protect Microsoft 365 from on-premises attacks - Microsoft Entra (original) (raw)

Many customers connect their private corporate networks to Microsoft 365 to benefit their users, devices, and applications. Threat actors can compromise these private networks in many well-documented ways. Microsoft 365 acts as a sort of nervous system for organizations that invested in modernizing their environment to the cloud. It's critical to protect Microsoft 365 from on-premises infrastructure compromise.

This article shows you how to configure your systems to help protect your Microsoft 365 cloud environment from on-premises compromise:

Microsoft strongly recommends that you implement the guidance in this article.

Threat sources in on-premises environments

Your Microsoft 365 cloud environment benefits from an extensive monitoring and security infrastructure. Microsoft 365 uses machine learning and human intelligence to look across worldwide traffic. It can rapidly detect attacks and allow you to reconfigure nearly in real time.

Hybrid deployments can connect on-premises infrastructure to Microsoft 365. In such deployments, many organizations delegate trust to on-premises components for critical authentication and directory object state management decisions. If threat actors compromise the on-premises environment, these trust relationships become opportunities for them to also compromise your Microsoft 365 environment.

The two primary threat vectors are federation trust relationships and account synchronization. Both vectors can grant an attacker administrative access to your cloud.

Protect Microsoft 365 from on-premises compromise

To address on-premises threats, we recommend you adhere to the four principles that the following diagram illustrates.

Diagram showing reference architecture for protecting Microsoft 365, as described in the following list.

  1. Fully isolate your Microsoft 365 administrator accounts. They should be:
  2. Manage devices from Microsoft 365. Use Microsoft Entra join and cloud-based mobile device management (MDM) to eliminate dependencies on your on-premises device management infrastructure. These dependencies can compromise device and security controls.
  3. Ensure no on-premises account has elevated privileges to Microsoft 365. Some accounts access on-premises applications that require NTLM, Lightweight Directory Access Protocol (LDAP), or Kerberos authentication. These accounts must be in the organization's on-premises identity infrastructure. Ensure that you don't include these accounts, along with service accounts, in privileged cloud roles or groups. Ensure that changes to these accounts can't affect the integrity of your cloud environment. Privileged on-premises software must not be capable of affecting Microsoft 365 privileged accounts or roles.
  4. Use Microsoft Entra cloud authentication to eliminate dependencies on your on-premises credentials. Always use phishing-resistant authentication methods, such as Windows Hello for Business, Platform Credential for macOS, Passkeys (FIDO2), Microsoft Authenticator passkeys, or certificate-based authentication.

Specific security recommendations

The following sections provide guidance on how to implement the principles in this article.

Isolate privileged identities

In Microsoft Entra ID, users who have privileged roles, such as administrators, are the root of trust to build and manage the rest of the environment. Implement the following practices to minimize the effects of a compromise.

For more information, see Securing privileged access and Secure access practices for administrators in Microsoft Entra ID.

Use cloud authentication

Credentials are a primary attack vector. Implement the following practices to make credentials more secure:

Provision user access from the cloud

Provisioning refers to the creation of user accounts and groups in applications or identity providers.

Diagram of provisioning architecture shows the interaction of Microsoft Entra ID with Cloud HR, Microsoft Entra B2B, Azure app provisioning, and group-based licensing.

We recommend the following provisioning methods:

Use cloud groups for collaboration and access

Cloud groups allow you to decouple your collaboration and access from your on-premises infrastructure.

Consider owners of groups used for access as privileged identities to avoid membership takeover in an on-premises compromise. Takeovers include direct on-premises group membership manipulation or on-premises attribute manipulation that can affect Microsoft 365 dynamic group membership.

Manage devices from the cloud

Securely manage devices with Microsoft Entra capabilities.

Deploy Microsoft Entra joined Windows 11 workstations with mobile device management policies. Enable Windows Autopilot for a fully automated provisioning experience. See Plan your Microsoft Entra join implementation.

Workloads, applications, and resources

This section provides recommendations to protect from on-premises attacks on workloads, applications, and resources.

Conditional Access policies

Use Microsoft Entra Conditional Access to interpret signals and use them to make authentication decisions. For more information, see the Conditional Access deployment plan.

Monitor

After you configure your environment to protect your Microsoft 365 from on-premises compromises, proactively monitor the environment. For more information, see What is Microsoft Entra monitoring.

Monitor the following key scenarios, in addition to any scenarios specific to your organization.

For comprehensive guidance on this topic, check Microsoft Entra security operations guide.

Log management

Define a log storage and retention strategy, design, and implementation to facilitate a consistent tool set. For example, consider security information and event management (SIEM) systems like Microsoft Sentinel, common queries, and investigation and forensics playbooks.

For comprehensive guidance on this topic, check Incident response playbooks and Investigate risky users with Copilot

Next steps