Clarify MT.1020 for Microsoft Entra Connect application-based authentication

powershell/public/maester/entra/Test-MtCaExclusionForDirectorySyncAccount.ps1

@@ -1,19 +1,32 @@
 function Test-MtCaExclusionForDirectorySyncAccount {
     <#
     .Synopsis
-    Checks if all Conditional Access policies scoped to all cloud apps and all users exclude the directory synchronization accounts
+    Checks whether Conditional Access policies exclude user-based Microsoft Entra Connect synchronization identities.
 
     .Description
-    The directory synchronization accounts are used to synchronize the on-premises directory with Entra ID.
-    These accounts should be excluded from all Conditional Access policies scoped to all cloud apps and all users.
-    Entra ID connect does not support multifactor authentication.
-    Restrict access with these accounts to trusted networks.
+    Microsoft Entra Connect uses a connector identity to synchronize an on-premises directory with Microsoft Entra ID.
+    Legacy installations can use a user-based directory synchronization account. These accounts should be excluded from
+    Conditional Access policies scoped to all cloud apps and all users, and their access should be restricted to trusted
+    networks.
+
+    New installations of Microsoft Entra Connect 2.5.76.0 or later use application-based authentication by default, with a
+    service principal and certificate instead of a user account and password. Existing installations do not switch to
+    application-based authentication automatically.
+
+    This test evaluates user principals assigned to the directory synchronization roles. It passes automatically when no
+    user principals remain, because Conditional Access user exclusions do not apply to service principals; the test does not
+    need to be muted. To verify the authentication method currently used, run Get-ADSyncEntraConnectorCredential on every
+    Microsoft Entra Connect server and confirm that ConnectorIdentityType is Application. After verifying the migration,
+    remove the legacy directory synchronization account or remove its directory synchronization role assignment.
 
     .Example
     Test-MtCaExclusionForDirectorySyncAccount
 
     .LINK
     https://maester.dev/docs/commands/Test-MtCaExclusionForDirectorySyncAccount
+
+    .LINK
+    https://learn.microsoft.com/entra/identity/hybrid/connect/authenticate-application-id
     #>
     [CmdletBinding()]
     [OutputType([bool])]
@@ -51,18 +64,15 @@
             return $true
         }
 
-        # Classify members: user accounts (subject to CA policies) vs. service principals (not subject to CA).
-        # As of Microsoft Entra Connect v2.5.76.0, directory sync supports Application-Based Authentication
-        # (ABA), where sync is performed by a registered service principal rather than a dedicated user
-        # account. Service principals are not subject to Conditional Access policies and do not need to be
-        # excluded from them.
+        # Classify role members by whether Conditional Access user targeting applies. Role membership establishes
+        # whether user principals need CA handling, but it does not prove which credential an active Connect server uses.
         $userSyncMembers = @($Members | Where-Object { $_.'@odata.type' -ne '#microsoft.graph.servicePrincipal' })
         $spSyncMembers   = @($Members | Where-Object { $_.'@odata.type' -eq '#microsoft.graph.servicePrincipal' })
 
         if ( $userSyncMembers.Count -eq 0 -and $spSyncMembers.Count -gt 0 ) {
             $spNames = ( $spSyncMembers | Where-Object { $_.displayName } | ForEach-Object { $_.displayName } ) -join ', '
             if ( -not $spNames ) { $spNames = 'unknown' }
-            Add-MtTestResultDetail -Description $testDescription -Result "This tenant uses Application-Based Authentication (ABA) for directory synchronization. As of Microsoft Entra Connect v2.5.76.0, sync can be performed by a registered service principal ($spNames) rather than a dedicated user account. Service principals are not subject to Conditional Access policies; no CA exclusions are required."
+            Add-MtTestResultDetail -Description $testDescription -Result "Only service principals are assigned to the directory synchronization roles ($spNames). Conditional Access user exclusions do not apply to service principals, so this test is not applicable. Role membership alone does not confirm that an active Microsoft Entra Connect server uses application-based authentication; verify each server with Get-ADSyncEntraConnectorCredential."
             return $true
         }
 

powershell/tests/functions/Test-MtCaExclusionForDirectorySyncAccount.Tests.ps1

@@ -104,21 +104,34 @@
         }
     }
 
-    Context 'Service principal-only members (ABA — Application-Based Authentication, Entra Connect v2.5.76.0+)' {
-
-        BeforeEach {
-            # Only a service principal is in the role — this is the ABA pattern (Entra Connect v2.5.76.0+).
-            # The new code returns true early (before iterating policies) with an informative ABA message.
-            Mock -ModuleName Maester Get-MtRoleMember { return $script:syncServicePrincipal }
-            Mock -ModuleName Maester Get-MtConditionalAccessPolicy {
-                return @(New-CaPolicy -ExcludeUsers @() -ExcludeRoles @())
-            }
-        }
-
-        It 'Should return true because ABA service principals are not subject to CA policies' {
-            Test-MtCaExclusionForDirectorySyncAccount | Should -BeTrue
-        }
-    }
+    Context 'Service principal-only synchronization role members' {
+
+        BeforeEach {
+            # Role membership is sufficient to determine CA applicability, but does not prove which connector identity is active.
+            Mock -ModuleName Maester Get-MtRoleMember { return $script:syncServicePrincipal }
+            Mock -ModuleName Maester Get-MtConditionalAccessPolicy {
+                return @(New-CaPolicy -ExcludeUsers @() -ExcludeRoles @())
+            }
+        }
+
+        It 'Should return true without querying CA policies because user exclusions do not apply' {
+            Test-MtCaExclusionForDirectorySyncAccount | Should -BeTrue
+
+            Should -Invoke Get-MtConditionalAccessPolicy -ModuleName Maester -Times 0 -Exactly
+        }
+
+        It 'Should not claim that role membership proves application-based authentication is active' {
+            Test-MtCaExclusionForDirectorySyncAccount | Should -BeTrue
+
+            Should -Invoke Add-MtTestResultDetail -ModuleName Maester -Times 1 -Exactly -ParameterFilter {
+                $Result -like 'Only service principals are assigned*' -and
+                $Result -like '*this test is not applicable*' -and
+                $Result -like '*Role membership alone does not confirm*' -and
+                $Result -like '*Get-ADSyncEntraConnectorCredential*' -and
+                $Result -notlike '*This tenant uses Application-Based Authentication*'
+            }
+        }
+    }
 
     Context 'Policy does not target all applications' {