MT.1111: High privileged user should be linked to an identity.


ID	`MT.1111`
Severity	Low
Suite	Mito
Product	Defender
Feature	Exposure Management
Security area	Privileged access
Resource type	User
User impact of fixing	Low
Effort to fix	Low
Framework controls	`nist-800-53-r5:AC-2` Account Management
Reads from	Microsoft Graph
Lifecycle	Preview

What this checks and how to fix it

Linking a privileged user account to the primary work account in Microsoft Defender XDR makes it easier to detect, prioritize, and contain attacks that target highly sensitive identities. It also improves incident response because all relevant activity and risk signals are correlated to the real person behind both identities, reducing blind spots and investigation time.

This use case is explicitly described in the Defender XDR documentation: A user might have two accounts, one for everyday work and another with elevated permissions for administrative tasks. Example

john.smith@company.com (regular account) john.smith.admin@company.com (privileged account)

How to fix

Review the accounts in the Identity inventory of Microsoft Defender portal and add a manual link from the identity page of the (primary) user account to the privileged account.

Mito check. Author: Cloud-Architekt. Open-source licences.

Open-source licences. CIS Benchmark material © Center for Internet Security, Inc.; CISA SCuBA baselines are public domain (CC0).