Skip to main content
Version: 2.2.1-preview

Test-MtCaExclusionForDirectorySyncAccount

SYNOPSIS​

Checks whether Conditional Access policies exclude user-based Microsoft Entra Connect synchronization identities.

SYNTAX​

Test-MtCaExclusionForDirectorySyncAccount [-ProgressAction <ActionPreference>] [<CommonParameters>]

DESCRIPTION​

Microsoft Entra Connect uses a connector identity to synchronize an on-premises directory with Microsoft Entra ID. Legacy installations can use a user-based directory synchronization account. These accounts should be excluded from Conditional Access policies scoped to all cloud apps and all users, and their access should be restricted to trusted networks.

New installations of Microsoft Entra Connect 2.5.76.0 or later use application-based authentication by default, with a service principal and certificate instead of a user account and password. Existing installations do not switch to application-based authentication automatically.

This test evaluates user principals assigned to the directory synchronization roles. It passes automatically when no user principals remain, because Conditional Access user exclusions do not apply to service principals; the test does not need to be muted. To verify the authentication method currently used, run Get-ADSyncEntraConnectorCredential on every Microsoft Entra Connect server and confirm that ConnectorIdentityType is Application. After verifying the migration, remove the legacy directory synchronization account or remove its directory synchronization role assignment.

EXAMPLES​

EXAMPLE 1​

Test-MtCaExclusionForDirectorySyncAccount

PARAMETERS​

-ProgressAction​

Determines how PowerShell responds to progress updates generated by a script, cmdlet, or provider, such as the progress bars generated by Write-Progress.

Type: ActionPreference
Parameter Sets: (All)
Aliases: proga

Required: False
Position: Named
Default value: None
Accept pipeline input: False
Accept wildcard characters: False

CommonParameters​

This cmdlet supports the common parameters: -Debug, -ErrorAction, -ErrorVariable, -InformationAction, -InformationVariable, -OutVariable, -OutBuffer, -PipelineVariable, -Verbose, -WarningAction, and -WarningVariable. For more information, see about_CommonParameters.

INPUTS​

OUTPUTS​

System.Boolean​

NOTES​

https://maester.dev/docs/commands/Test-MtCaExclusionForDirectorySyncAccount

https://learn.microsoft.com/entra/identity/hybrid/connect/authenticate-application-id