Skip to content
This repository was archived by the owner on Sep 17, 2026. It is now read-only.

SecOps - 41012 - Microsoft Entra Connect synchronization account does not hold unnecessary replication permissions - #1553

Closed
aahmed-spec wants to merge 31 commits into
microsoft:devfrom
astaykov:test-41012
Closed

aahmed-spec wants to merge 31 commits into
microsoft:devfrom
astaykov:test-41012

Conversation

@aahmed-spec

Copy link
Copy Markdown
Collaborator

No description provided.

# Conflicts:
#	src/powershell/assets/ReportTemplate.classic.html
#	src/powershell/assets/ReportTemplate.html
Fix condition for excluding plans in export config
SecOps - 41004 - Privileged accounts in Active Directory have the "Account is sensitive and cannot be delegated" flag set
SecOps - 41011 - Non-administrative accounts do not have DC-Sync (Directory Replication) permissions
Data - 35063 - 35064 - UI implementation
Optimize Application export with targeted Graph property selection
…ers-dev

Refactor 21868 to improve performance using exported data instead of live API calls
SecOps - 41119 - Local modification of Microsoft Defender Antivirus policy is blocked
… not hold unnecessary replication permissions

Copilot AI left a comment

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

🟡 Changes recommended

UTC timestamps can be converted to local dates and lose their time component in the report.

Get a fresh assessment by requesting another Copilot review.

Pull request overview

Adds assessment 41012 to evaluate unnecessary Microsoft Entra Connect replication permissions through Microsoft Secure Score.

Changes:

  • Adds Graph-based profile and score validation with Pass/Fail/Investigate outcomes.
  • Adds remediation guidance and references.
File summaries
File Description
Test-Assessment.41012.ps1 Implements assessment and reporting logic.
Test-Assessment.41012.md Documents risk and remediation.
Review details
  • Files reviewed: 30/32 changed files
  • Comments generated: 1
  • Review effort level: Balanced

💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.

Comment on lines +273 to +277
$lastSyncedDisplay = if ($null -ne $lastSyncedTime) {
Get-FormattedDate -DateString $lastSyncedTime.ToString('o')
} else { '—' }

$snapshotDisplay = if ($null -ne $snapshotTime) { Get-FormattedDate -DateString $snapshotTime.ToString('o') } else { '—' }
Sign up for free to subscribe to this conversation on GitHub. Already have an account? Sign in.

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

8 participants