AD-FORS-01: UPN suffixes count should be retrievable


ID	`AD-FORS-01`
Severity	Info
Suite	Active Directory (on-premises)
Product	Active Directory
Feature	Domain and forest
Security area	Infrastructure hardening
Resource type	Tenant
Reads from	On-premises Active Directory

What this checks and how to fix it

UPN (User Principal Name) suffixes are a critical component of Active Directory authentication infrastructure. They allow users to log on using an email-style username format (user@suffix) rather than the traditional domain\username format. Understanding the UPN suffix configuration is important for:

Authentication Experience: UPN suffixes enable a consistent logon experience across multiple domains and forests
Identity Management: During mergers and acquisitions, UPN suffixes help maintain brand identity while consolidating directories
Security Assessment: Unnecessary or unauthorized UPN suffixes could indicate misconfiguration or security risks
Compliance: Some compliance frameworks require visibility into all authentication namespaces

Control Type

Operational

Security Recommendation

Regularly review configured UPN suffixes to ensure:

Only legitimate organizational domains are configured as UPN suffixes
Unused or deprecated UPN suffixes from past mergers are removed
UPN suffixes align with the organization’s current domain and brand strategy

How the Test Works

This test retrieves the UPN suffixes configured at the forest level using the Get-ADForest cmdlet. It counts the number of custom UPN suffixes and reports whether any are configured. The default forest domain is not counted as a custom suffix.

Test-MtAdUpnSuffixesDetails - Provides detailed list of all configured UPN suffixes
Test-MtAdSpnSuffixesCount - Checks SPN suffix configuration for service principal management

Mito check. Author: soulemike. Open-source licences.

Open-source licences. CIS Benchmark material © Center for Internet Security, Inc.; CISA SCuBA baselines are public domain (CC0).