AZ_PASSWORD_WRITEBACK

Summary

Forestall ACL Alias	AZ_PASSWORD_WRITEBACK
Entra ID (Azure AD) Alias	Password writeback
Affected Object Types	AZ Users, Users
Exploitation Certainty	Certain

Description

AZ_PASSWORD_WRITEBACK represents that password writeback is enabled for a hybrid identity deployment.

Password writeback allows password resets/changes performed in Microsoft Entra ID (for synced users) to be written back to on-premises Active Directory Domain Services (AD DS) in near real time through Microsoft Entra Connect or Cloud Sync.

Security impact:

• This feature creates a cloud -> on-prem credential control path.

• If an attacker can reset a synced user's password in Entra ID (for example via AZ_RESET_PASSWORD or mis-scoped SSPR), the attacker may gain the corresponding on-prem AD password as well.

• The on-prem writeback agent enforces on-prem password policy when writing back.

Identification

Azure Portal

1. Log in to the Azure portal.

2. Open Microsoft Entra ID.

3. Click Password reset.

4. Click On-premises integration.

5. Locate Write back passwords to your on-premises directory.

6. Confirm whether it is checked or not.

Exploitation

AZ_PASSWORD_WRITEBACK is not an exploit by itself. It increases impact of other edges:

• If a principal can reset a synced user's password using AZ_RESET_PASSWORD in Entra ID, and password writeback is enabled, the reset can also update the on-prem AD password.

• If the target user is privileged on-prem (for example, can RDP/WinRM, is a local admin, or has AD rights), this can enable rapid pivot to on-prem infrastructure.

Mitigation

• Disable password writeback if it is not strictly required.

• Scope SSPR to the minimum set of users/groups and require strong authentication methods.

• Minimize who holds password reset capabilities (see AZ_RESET_PASSWORD) and prefer just-in-time privileged access (PIM).

Detection

Use the Microsoft Entra admin center:

1. Open Microsoft Entra ID -> Audit logs.

2. Filter Activity for Reset password or Reset user password.

3. Filter Category for UserManagement.

4. Review Initiated by (actor), Target, Date, and Status for password reset operations against synced users.

5. Use Manage view -> Edit columns if any of those fields are hidden.

References

• https://learn.microsoft.com/en-us/entra/identity/authentication/concept-sspr-writeback

• https://learn.microsoft.com/en-us/entra/identity/authentication/tutorial-enable-sspr-writeback

• https://learn.microsoft.com/en-us/entra/identity/authentication/tutorial-enable-cloud-sync-sspr-writeback

• https://learn.microsoft.com/en-us/entra/identity/hybrid/connect/how-to-connect-syncservice-features

• https://learn.microsoft.com/en-us/previous-versions/windows/it-pro/windows-10/security/threat-protection/auditing/event-4724