Listen to this Post
Introduction:
In hybrid identity environments, users often accumulate multiple digital personas—cloud-only accounts, on-prem synchronized users, and legacy service identities—creating “scattered identities” that evade traditional threat detection. Microsoft Defender for Identity (MDI) now offers a largely overlooked account linking capability that correlates these fragmented identities into a single security entity. This article extracts the technical essence of Thomas V.’s post, expands it with hands-on configuration steps, and provides PowerShell, KQL, and API-level guidance to operationalize identity threat detection and response (ITDR) at scale.
Learning Objectives:
- Understand scattered identities and their impact on ITDR visibility
- Configure account linking in Microsoft Defender for Identity via portal, Graph API, and PowerShell
- Hunt for unlinked identities and automate remediation using KQL and Microsoft Graph
You Should Know:
- Understanding Scattered Identities in Hybrid AD and Entra ID
Scattered identities occur when a single human user possesses multiple discrete objects across directories—for example, a domain-joinedCONTOSO\jdoe, an Entra ID user[email protected], and a privileged Azure AD service accountsvc-jdoe-api. Without explicit linking, Defender for Identity treats these as separate entities, blinding detection logic to lateral movement that spans on-premises and cloud resources.
Extended view:
Attackers exploit this visibility gap by compromising a cloud-only test account and pivoting to the synchronized admin account—MDI sees two unrelated users. Microsoft’s link accounts feature merges these identities under a single profile, allowing detection of cross-domain reconnaissance and privilege escalation.
2. Step‑by‑Step: Linking Accounts via Microsoft Defender Portal
This is the primary method referenced in the blog post. It enables security analysts to manually fuse identities without scripting.
- Navigate to Microsoft 365 Defender → Identities → Entities.
- Select an identity that has potential scattered duplicates.
- Click the Linked accounts tab → Link accounts.
- Search for the secondary identity (by UPN, SAM, or SID).
- Confirm the linkage and monitor the unified timeline.
What this does:
It instructs the MDI backend to merge telemetry from both sources, enriching future alerts with full context.
3. Automating Account Linkage with Microsoft Graph PowerShell
For bulk operations (e.g., linking all hybrid synced users or service accounts), the GUI is insufficient. Microsoft Graph exposes the `identityProtection` endpoint to manage linking programmatically.
Install required module Install-Module Microsoft.Graph -Scope CurrentUser Connect with appropriate scopes Connect-MgGraph -Scopes "IdentityRiskEvent.ReadWrite.All", "IdentityRiskyUser.ReadWrite.All" Retrieve user objects from on-prem and cloud $onpremUser = Get-MgUser -Filter "userPrincipalName eq 'contoso\jdoe'" $cloudUser = Get-MgUser -Filter "userPrincipalName eq '[email protected]'" Create a linking request $params = @{ targetIdentity = @{ id = $cloudUser.Id identityType = "user" } } Invoke-MgGraphRequest -Method POST ` -Uri "https://graph.microsoft.com/beta/identityProtection/riskyUsers/$($onpremUser.Id)/linkAccount" ` -Body ($params | ConvertTo-Json) ` -ContentType "application/json"
Why this matters:
This script allows SecOps teams to ingest HR data or identity governance feeds to proactively link accounts before an incident occurs.
4. Hunting for Unlinked Identities Using KQL in Advanced Hunting
To discover existing scattered identities, security teams must query both Active Directory and Entra ID logs.
KQL Query for Microsoft 365 Advanced Hunting:
IdentityLogonEvents
| where Timestamp > ago(30d)
| where AccountType in ("user", "serviceAccount")
| summarize Logons = count() by AccountUpn, AccountName, AccountDomain, DeviceName
| join kind=leftouter (
IdentityLogonEvents
| where Timestamp > ago(30d)
| summarize CloudLogons = count() by AccountUpn
) on AccountUpn
| where isempty(CloudLogons) and isnotempty(AccountDomain)
| project AccountUpn, AccountName, DomainLogons = Logons
| order by DomainLogons desc
This query surfaces on-premises accounts logging in frequently but with no corresponding cloud logon activity—likely candidates for unlinked hybrid identities.
5. Managing Linked Accounts via REST API for SIEM Integration
Direct API manipulation allows integration with SOAR platforms like Sentinel, Splunk, or Cortex XSOAR.
Endpoint:
`POST https://api.security.microsoft.com/api/identity/entities/{entityId}/linkedIdentities`
Sample cURL request:
curl -X POST -H "Authorization: Bearer $token" \
-H "Content-Type: application/json" \
-d '{
"linkedIdentity": {
"id": "cloud-user-object-id",
"type": "AzureADUser"
}
}' \
https://api.security.microsoft.com/api/identity/entities/onprem-sid-123/linkedIdentities
Best practice:
Use this endpoint to unify identities when onboarding new subsidiaries or merging directories after M&A activities.
6. Unlinking and Remediating False Positives
Occasionally, accounts are incorrectly linked (e.g., a shared mailbox linked to an executive). MDI supports unlinking without data loss.
- From the Entities page, open the merged profile.
- Click Linked accounts → select the secondary identity → Unlink.
- Verify in the entity timeline that subsequent events are no longer correlated.
Automation tip:
Schedule a monthly validation script that exports linked relationships and flags accounts with mismatched departments or titles for review.
7. Linux and Cross‑Platform Identity Considerations
While Defender for Identity primarily targets Windows identities, Linux servers joined to AD also generate scattered identities. Use `realmd` and `sssd` configuration checks to ensure UPN consistency.
Check if Linux host uses correct UPN suffix realm list | grep user-principal Force consistent UPN in SSSD echo "ad_domain = contoso.com" >> /etc/sssd/sssd.conf echo "use_fully_qualified_names = True" >> /etc/sssd/sssd.conf systemctl restart sssd
Aligning Linux AD join parameters prevents creation of fragmented identities that MDI cannot automatically correlate.
What Undercode Say:
- Scattered identities are the new shadow IT. Attackers know most organizations never fuse these accounts; linking them collapses the attack surface and exposes hidden lateral paths.
- Automation is mandatory at scale. Manual linking is sustainable only for VIPs; production use requires Graph API and PowerShell integration to sync with identity governance systems.
Microsoft Defender for Identity’s account linking feature addresses a fundamental architectural flaw in hybrid identity—the assumption that every user object is unique. By merging telemetry across directories, security teams gain a single pane of glass for investigation and detection. However, the tool is only as effective as the data hygiene behind it; organizations must pair this capability with rigorous provisioning policies and continuous hunting for orphans. When deployed correctly, this under‑the‑radar feature transforms MDI from a domain controller monitor into a true cross‑identity ITDR platform.
Prediction:
As hybrid work solidifies, identity providers will embed account linking directly into the synchronization engine rather than leaving it as a post‑config security toggle. Within 18 months, expect Microsoft and competitors to release auto‑linking heuristics based on behavioral biometrics and authentication patterns, rendering manual linking obsolete. Simultaneously, attackers will develop techniques to deliberately poison these links—forcing security teams to verify merged identities as aggressively as they currently validate single accounts. The era of identity correlation wars is just beginning.
▶️ Related Video (80% Match):
🎯Let’s Practice For Free:
IT/Security Reporter URL:
Reported By: Thomasvrhydn Identity – Hackers Feeds
Extra Hub: Undercode MoN
Basic Verification: Pass ✅
