> For the complete documentation index, see [llms.txt](https://docs.forestall.io/fsprotect/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://docs.forestall.io/fsprotect/edges/azure/az_password_writeback.md).

# AZ\_PASSWORD\_WRITEBACK

## Summary

|                               |                         |
| ----------------------------- | ----------------------- |
| **FSProtect ACL Alias**       | AZ\_PASSWORD\_WRITEBACK |
| **Entra ID (Azure AD) Alias** | Password writeback      |
| **Affected Object Types**     | AZ Group, Group         |
| **Exploitation Certainty**    | Certain                 |

## Description

`AZ_PASSWORD_WRITEBACK` represents that **password writeback is enabled** for a hybrid identity deployment.

Password writeback allows **password resets/changes performed in Microsoft Entra ID** (for synced users) to be **written back to on-premises Active Directory Domain Services (AD DS)** in near real time through Microsoft Entra Connect or Cloud Sync.

Security impact:

* This feature creates a **cloud → on-prem credential control path**.
* If an attacker can reset a synced user’s password in Entra ID (for example via `AZ_RESET_PASSWORD` or mis-scoped SSPR), the attacker may gain the corresponding **on-prem AD password** as well.
* The on-prem writeback agent enforces **on-prem password policy** when writing back.

## Identification

### Azure GUI

1. Log in to the Azure portal.
2. Open Microsoft Entra ID.
3. Click Password reset.
4. Click On-premises integration.
5. Locate Write back passwords to your on-premises directory.
6. Confirm whether it is checked or not.

## Exploitation

`AZ_PASSWORD_WRITEBACK` is **not** an exploit by itself. It increases impact of other edges:

* If a principal can reset a synced user’s password using [`AZ_RESET_PASSWORD`](https://docs.forestall.io/fsprotect/edges/azure/az_reset_password) in Entra ID, and password writeback is enabled, the reset can also update the **on-prem AD password**.
* If the target user is privileged on-prem (for example, can RDP/WinRM, is a local admin, or has AD rights), this can enable rapid pivot to on-prem infrastructure.

## Mitigation

* Disable password writeback if it is not strictly required.
* Scope **SSPR** to the minimum set of users/groups and require strong authentication methods.
* Minimize who holds password reset capabilities (see [`AZ_RESET_PASSWORD`](https://docs.forestall.io/fsprotect/edges/azure/az_reset_password)) and prefer just-in-time privileged access (PIM).

## Detection

### Azure

See [`AZ_RESET_PASSWORD`](https://docs.forestall.io/fsprotect/edges/azure/az_reset_password). Monitor Microsoft Entra **Audit logs** for password reset operations against synced users; with writeback enabled, these resets can also impact the on-prem AD password.

### Active Directory

See [`ForceChangePassword`](https://gitlab.com/forestall/fsprotect-knowledge-base/-/blob/main/AD/ForceChangePassword/README.md). Monitor on-prem AD events where user passwords are reset/changed or users are forced to change password at next logon; correlate the actor/service account used by the writeback mechanism.

## References

* <https://learn.microsoft.com/en-us/entra/identity/authentication/concept-sspr-writeback>
* <https://learn.microsoft.com/en-us/entra/identity/authentication/tutorial-enable-sspr-writeback>
* <https://learn.microsoft.com/en-us/entra/identity/authentication/tutorial-enable-cloud-sync-sspr-writeback>
* <https://learn.microsoft.com/en-us/entra/identity/hybrid/connect/how-to-connect-syncservice-features>
* <https://learn.microsoft.com/en-us/previous-versions/windows/it-pro/windows-10/security/threat-protection/auditing/event-4724>