> For the complete documentation index, see [llms.txt](https://docs.forestall.io/fsprotect/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://docs.forestall.io/fsprotect/edges/azure/az_password_writeback.md).

# AZ\_PASSWORD\_WRITEBACK

## Summary

|                               |                         |
| ----------------------------- | ----------------------- |
| **FSProtect ACL Alias**       | AZ\_PASSWORD\_WRITEBACK |
| **Entra ID (Azure AD) Alias** | Password writeback      |
| **Affected Object Types**     | AZ Group, Group         |
| **Exploitation Certainty**    | Certain                 |

## Description

`AZ_PASSWORD_WRITEBACK` represents that **password writeback is enabled** for a hybrid identity deployment.

Password writeback allows **password resets/changes performed in Microsoft Entra ID** (for synced users) to be **written back to on-premises Active Directory Domain Services (AD DS)** in near real time through Microsoft Entra Connect or Cloud Sync.

Security impact:

* This feature creates a **cloud → on-prem credential control path**.
* If an attacker can reset a synced user’s password in Entra ID (for example via `AZ_RESET_PASSWORD` or mis-scoped SSPR), the attacker may gain the corresponding **on-prem AD password** as well.
* The on-prem writeback agent enforces **on-prem password policy** when writing back.

## Identification

### Azure GUI

1. Log in to the Azure portal.
2. Open Microsoft Entra ID.
3. Click Password reset.
4. Click On-premises integration.
5. Locate Write back passwords to your on-premises directory.
6. Confirm whether it is checked or not.

## Exploitation

`AZ_PASSWORD_WRITEBACK` is **not** an exploit by itself. It increases impact of other edges:

* If a principal can reset a synced user’s password using [`AZ_RESET_PASSWORD`](https://docs.forestall.io/fsprotect/edges/azure/az_reset_password) in Entra ID, and password writeback is enabled, the reset can also update the **on-prem AD password**.
* If the target user is privileged on-prem (for example, can RDP/WinRM, is a local admin, or has AD rights), this can enable rapid pivot to on-prem infrastructure.

## Mitigation

* Disable password writeback if it is not strictly required.
* Scope **SSPR** to the minimum set of users/groups and require strong authentication methods.
* Minimize who holds password reset capabilities (see [`AZ_RESET_PASSWORD`](https://docs.forestall.io/fsprotect/edges/azure/az_reset_password)) and prefer just-in-time privileged access (PIM).

## Detection

### Azure

See [`AZ_RESET_PASSWORD`](https://docs.forestall.io/fsprotect/edges/azure/az_reset_password). Monitor Microsoft Entra **Audit logs** for password reset operations against synced users; with writeback enabled, these resets can also impact the on-prem AD password.

### Active Directory

See [`ForceChangePassword`](https://gitlab.com/forestall/fsprotect-knowledge-base/-/blob/main/AD/ForceChangePassword/README.md). Monitor on-prem AD events where user passwords are reset/changed or users are forced to change password at next logon; correlate the actor/service account used by the writeback mechanism.

## References

* <https://learn.microsoft.com/en-us/entra/identity/authentication/concept-sspr-writeback>
* <https://learn.microsoft.com/en-us/entra/identity/authentication/tutorial-enable-sspr-writeback>
* <https://learn.microsoft.com/en-us/entra/identity/authentication/tutorial-enable-cloud-sync-sspr-writeback>
* <https://learn.microsoft.com/en-us/entra/identity/hybrid/connect/how-to-connect-syncservice-features>
* <https://learn.microsoft.com/en-us/previous-versions/windows/it-pro/windows-10/security/threat-protection/auditing/event-4724>


---

# Agent Instructions
This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com.

## Querying This Documentation
If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question.

Perform an HTTP GET request on the current page URL with the `ask` query parameter:

```
GET https://docs.forestall.io/fsprotect/edges/azure/az_password_writeback.md?ask=<question>
```

The question should be specific, self-contained, and written in natural language.
The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.

Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.