MT.1020 not catching dir sync accounts

[vegazbabz]

This test is not catching the directory synchronization accounts:
https://maester.dev/docs/tests/MT.1020/

[merill]

Can you share some details on what you are seeing and what you expected to see?

Any repro steps would help.

Thanks

[vegazbabz]

I have tried it from both an Azure DevOps pipeline and from a local PS session.

I think you need to check for the Entra User displayname "On-Premises Directory Synchronization Service Account" or upn beginning with "sync_". Not sure how you do the check today, but I have 7 CA Policies that shows up as not having the sync dir acc in them. But that is not true, as we do not have them excepted.
So your check for that service account is erroneous.

[merill]

Got it. I see the error now.

Microsoft made changes to the role for the sync account. This could be why Maester is failing to detect this in tenants.

@f-bader if you have bandwidth to check on this. Tx

https://github.com/maester365/maester/blob/main/powershell/public/Test-MtCaExclusionForDirectorySyncAccount.ps1

[vegazbabz]

@f-bader

You might want to add another check in the if clause, checking for excludeUsers and not only excludeRoles like:
-or ( $DirectorySynchronizationAccounts -in $policy.conditions.users.excludeUsers)

if ( $PolicyIncludesAllUsers -or $PolicyIncludesRole ) {
            # Skip this policy, because all directory synchronization accounts are included and therefor must not be excluded
            $currentresult = $true
            Write-Verbose "Skipping $($policy.displayName) - $currentresult"
        } else {
            if (( $DirectorySynchronizationAccountRoleTemplateId -in $policy.conditions.users.excludeRoles) -or ( $DirectorySynchronizationAccounts -in $policy.conditions.users.excludeUsers) ) {
                # Directory synchronization accounts are excluded
                $currentresult = $true
            } else {
                # Directory synchronization accounts are not excluded
                $currentresult = $false
                $result = $false
                $testResult += "  - [$($policy.displayname)](https://entra.microsoft.com/#view/Microsoft_AAD_ConditionalAccess/PolicyBlade/policyId/$($($policy.id))?%23view/Microsoft_AAD_ConditionalAccess/ConditionalAccessBlade/~/Policies?=)`n"
            }
        }