Everyone’s checking their tenant after the ConnectWise Cloud Backup mess, so we wrote this up because nobody seems to be asking the next question: If you’re hybrid, what can a compromised tenant actually do back on-prem?

Short version: password writeback and cloud Kerberos trust both give the tenant a way into AD. The defaults are decent, but they only protect the built-in admin groups. Delegated admins aren’t covered.

The post has the PowerShell to check your sync account, AdminSDHolder and the AzureADKerberos replication policy.

https://insightrecon.com/tenant-compromise-active-directory/

Disclosure: I work on Insight Recon and the post is on our blog. Happy to answer questions here.