Skip to content
MitoMito Docs

MT.1147: Do not sync krbtgt_AzureAD to Entra ID.
ID MT.1147
Severity High
Suite Mito
Product Entra ID
Related products Active Directory
Feature Hybrid identity
Security area Infrastructure hardening
Resource type User
User impact of fixing Low
Effort to fix Low
Framework controls nist-800-53-r5:IA-5 Authenticator Management
nist-800-53-r5:AC-6 Least Privilege
MITRE ATT&CK T1558
Reads from Microsoft Graph

What this checks and how to fix it

Section titled “What this checks and how to fix it”

Ensure krbtgt_AzureAD is not synchronized from on-premises Active Directory.

The krbtgt_AzureAD account is a sensitive identity used by Microsoft’s cloud services for Microsoft Entra Kerberos scenarios. Microsoft recommends keeping a clear separation between cloud and on-premises environments and not synchronizing this account to Entra ID. Synchronizing an on-premises krbtgt_AzureAD account creates an unnecessary privilege escalation path between the environments.

Remediation action

Section titled “Remediation action”
  1. Review your Microsoft Entra Connect synchronization scope and identify the on-premises krbtgt_AzureAD account.
  2. Exclude that account from synchronization, for example by OU filtering or domain filtering, so it is not synced to Entra ID.
  3. Run a synchronization cycle and confirm that no synchronized krbtgt_AzureAD account remains in Entra ID.
Section titled “Related links”

Mito check. Author: f-bader. Open-source licences.

Open-source licences. CIS Benchmark material © Center for Internet Security, Inc.; CISA SCuBA baselines are public domain (CC0).

© 2026 Virtual Petals. Mito is a Virtual Petals service, hosted in Microsoft Azure UAE North.