Posture check · Delegation and Kerberos
Delegated managed service account can take over another account's keys (T1078.002, T1558)
A delegated managed service account is linked to this account as its replacement, and accounts outside its owners can read its keys or control it. Through that link they receive this account's keys. This is the part of the 2025 BadSuccessor issue that Microsoft's fix does not close.
Why it matters
Anyone who can read the managed account's keys, or control it, can authenticate as this account.
How GraphnAI finds it
It runs after every sync, on each connected domain or tenant on its own. It applies to Active Directory.
It reads:
- The directory attributes
msDS-ManagedAccountPrecededByLink,msDS-DelegatedMSAState,msDS-SupersededManagedAccountLink,msDS-SupersededServiceAccountState,msDS-GroupMSAMembership,objectClass,objectSidanduserAccountControl - Directory permissions (access control entries)
- The privilege tier classification
Tiered Fidelity™ level: Constrained
Every finding from this check carries the Constrained level.
- TheoreticalConfigured in the directory. Nothing else checked.
- ConstrainedThis checkA constraint on it has been checked.
- ValidatedTelemetry has seen it in use.
Why there's no automatic fix
GraphnAI doesn't change managed account migrations, because the wrong change breaks the service being migrated.
How to fix it
Remove the link if this migration isn't yours, or limit who can read and control the managed account.
MITRE ATT&CK® technique names and MITRE D3FEND™ technique labels: © The MITRE Corporation. This work is reproduced and distributed with the permission of The MITRE Corporation. ATT&CK® is a registered trademark and D3FEND™ a trademark of The MITRE Corporation.
See it on your own directory.
The Public Preview is free for 30 days from your first sync, on your own server.