SyncJacked - Hijacking Identities Through Entra Connect Synchronization

SyncJacked - Hijacking Identities Through Entra Connect Synchronization

Speakers: Tomer Nahum, Security Researcher, Semperis

Conference: fwd:cloudsec Europe 2025

YouTube: https://www.youtube.com/watch?v=CFF3BcjQTwo

Overview

Tomer Nahum, a security researcher at Semperis, presented two identity takeover vulnerabilities in Microsoft Entra Connect — the synchronization engine that bridges on-premises Active Directory with Entra ID (formerly Azure AD). The first vulnerability abuses the soft matching mechanism to hijack cloud-only accounts with eligible privileged roles. The second, dubbed SyncJacked, exploits the hard matching mechanism to take over already-synced accounts with active privileged roles. Both attacks allow an attacker with relatively modest on-premises AD permissions to escalate to Global Administrator in Entra ID by manipulating the identity synchronization process. The SyncJacked vulnerability was confirmed by MSRC as an important privilege escalation vulnerability in 2025, after being initially dismissed as "by design" in 2022.

Background

▶ Watch: Explaining Entra Connect matching mechanisms — soft matching vs hard matching (1:30)

Entra Connect (formerly Azure AD Connect) is an application used to synchronize users between on-premises Active Directory and Entra ID. It copies relevant attributes from AD users and creates or updates corresponding cloud identities. A critical component of this process is the password hash synchronization (PHS) mechanism, which replicates password hashes from on-premises AD to Entra ID.

The fundamental challenge Entra Connect must solve is matching: how does it determine that an on-premises AD user corresponds to a specific Entra ID user? Microsoft implements two matching mechanisms. Soft matching links users based on two attributes — the User Principal Name (UPN) and the proxy address (primary SMTP address). If both match between an AD user and an Entra ID user, they are linked. Hard matching uses a more permanent identifier called the source anchor, which maps to the msDS-ConsistencyGuid attribute in AD and the ImmutableID in Entra ID. For newer versions of Entra Connect, the msDS-ConsistencyGuid is used; if unpopulated, the objectGUID is converted to a Base64 string and written to this attribute.

Entra ID users come in two flavors relevant to this research: synced users (linked to an on-premises account through Entra Connect) and unsynced users (cloud-managed accounts with no on-premises counterpart). Similarly, Entra ID role assignments can be active (permissions immediately available) or eligible (requiring on-demand activation through Privileged Identity Management, which may require MFA, justification, or other approval workflows).

Key Findings

▶ Watch: Live walkthrough of hijacking Johnny Sherman's eligible Global Admin via soft... (6:00)

Soft matching abuse bypasses the fix for active role takeover. The original soft matching vulnerability, discovered by Dirk-jan Mollema, allowed syncing an unsynced AD user to an unsynced Entra ID user with an active privileged role. Microsoft fixed this specific scenario. However, Nahum and co-researcher Sapir Fedorovsky discovered that the fix only applies to active role assignments. An attacker can still use soft matching to hijack an Entra ID account with an eligible privileged role — one that requires PIM activation. Once the identity is taken over via password hash sync, the attacker can activate the eligible role themselves.

SyncJacked enables takeover of already-synced privileged accounts. Unlike the soft matching attack (which targets unsynced cloud accounts), SyncJacked targets accounts that are already synchronized. The attacker copies the target's UPN and msDS-ConsistencyGuid to an attacker-controlled AD account, then deletes the legitimate synced AD account. Entra Connect then re-links the attacker's account to the target's Entra ID identity, syncing the attacker's password hash. This works for both active and eligible roles, making it strictly more powerful than the soft matching attack.

Forensic footprint is minimal. Both attacks produce only two log entries in Entra ID: a display name change and a password change. These are events that occur routinely during normal synchronization operations, making detection extremely challenging.

Technical Deep Dive

▶ Watch: Minimal forensic footprint — only display name and password change logs visible (8:30)

Soft Matching Attack

The required permissions for the soft matching attack are relatively accessible: the attacker needs one of create user object permission (with ownership of the created user), write access to a syncable OU (an Organizational Unit configured for Entra Connect synchronization), or Account Operators group membership.

The attack proceeds as follows: the attacker identifies a target Entra ID user (e.g., "Johnny Sherman") who is unsynced and has an eligible Global Administrator role. The attacker creates a new AD user (e.g., "Louie") and copies Johnny Sherman's UPN and proxy address from Entra ID to Louie's AD attributes. When Entra Connect's synchronization cycle runs, it soft-matches Louie to Johnny Sherman based on the matching UPN and proxy address. The password hash sync then overwrites Johnny Sherman's Entra ID password with Louie's AD password. The attacker can now sign in as Johnny Sherman and activate the eligible Global Administrator role.

SyncJacked (Hard Matching Attack)

SyncJacked requires write all properties or generic write on an unsynced on-premises account, plus delete permissions on the synchronized AD object being targeted. Alternatively, user delegation on a syncable OU or Account Operators membership provides sufficient access.

The attack targets a synced Entra ID user (e.g., "Bobby") with an active Global Administrator role. The attacker copies Bobby's UPN to a different AD account (e.g., "Robert") and also copies Bobby's msDS-ConsistencyGuid (or derives it from the ImmutableID visible in Entra ID). The attacker then deletes Bobby's original AD account. When synchronization runs, Entra Connect hard-matches Robert to Bobby's Entra ID identity via the copied source anchor. Robert's password hash replaces Bobby's, and the attacker now controls the Global Administrator account.

The critical difference from soft matching: hard matching cannot be disabled without breaking synchronization entirely, since it is the fundamental mechanism for maintaining identity linkage. Microsoft's recommendation is limited to requiring MFA on sign-in and role activation.

Disclosure Timeline

The vulnerability was first reported to MSRC in 2022. Microsoft initially provided hardening guidelines that did not address the issue, then updated documentation with additional hardening guidelines, and finally classified it as "by design." In 2025, after Nahum submitted additional information, MSRC reopened the case and confirmed it as an important privilege escalation vulnerability. A fix is currently under development, and Microsoft approved this public disclosure.

Demo / Proof of Concept

▶ Watch: Demonstrating SyncJacked takeover of Bobby's active Global Admin account (12:00)

Nahum demonstrated both attacks through the Entra ID administrative interface, showing the before-and-after states of the targeted accounts. For the soft matching attack, he showed Johnny Sherman's eligible Global Administrator role and the attribute copying process, followed by the synchronized state with the display name changed to "Louie" while retaining the eligible role. For SyncJacked, he demonstrated Bobby's active Global Administrator role being transferred to Robert through the hard matching manipulation. Both demonstrations showed the minimal log footprint — only display name and password change events.

Defensive Implications

▶ Watch: Disclosure timeline: from 2022 'by design' dismissal to 2025 confirmed vulner... (13:30)

Defenders should implement the following mitigations:

• Disable soft matching entirely if it is not operationally required. This eliminates the first attack vector.
• Require MFA for all PIM eligible role activations and for sign-in to privileged accounts. This is the primary mitigation for SyncJacked since hard matching cannot be disabled.
• Never sync privileged Entra ID accounts to on-premises AD. If a user has a privileged role in Entra ID, that identity should be cloud-only and excluded from synchronization scopes.
• Restrict Entra Connect synchronization to specific OUs to minimize the attack surface for users who can create or modify objects in syncable OUs.
• Monitor for display name and password changes on privileged Entra ID accounts that coincide with synchronization cycles, as these are the only forensic indicators of both attacks.
• Audit Account Operators membership and write permissions on syncable OUs, as these are the key permissions enabling both attacks.

Key Takeaways

• Entra Connect's identity matching mechanisms (soft and hard matching) can be weaponized for privilege escalation from on-premises AD to Entra ID Global Administrator.
• The soft matching fix only covers active role assignments — eligible roles remain exploitable.
• SyncJacked enables takeover of already-synced accounts and cannot be mitigated by disabling matching mechanisms.
• Both attacks leave a minimal forensic footprint (display name change + password change), making detection difficult.
• MFA enforcement on privileged accounts is the most effective mitigation since the underlying synchronization behavior cannot be easily changed.
• Persistence and re-engagement with MSRC can lead to vulnerability re-classification — the 2022 "by design" dismissal was overturned in 2025.

About the Speaker(s)

Tomer Nahum is a security researcher at Semperis, specializing in Active Directory and Entra ID identity security. He focuses on research at the intersection of on-premises AD and cloud identity synchronization. The soft matching abuse research was conducted in collaboration with Sapir Fedorovsky, also a researcher at Semperis. Nahum credited Dirk-jan Mollema's original soft matching research as the foundation for this extended work.